If the content has to be signed by its true origin, does it matter who's technically serving the content? There could be privacy considerations I suppose, but

If the content has to be signed by its true origin, does it matter who's technically serving the content? There could be privacy considerations I suppose, but the standard addresses that already: https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html#rfc.section.6 https://wicg.github.io/webpackage/draft-yasskin-http-origin-...