One solution that would go part way there is signed for browsers to only run signed javascript when it originates off site. Common libraries that are distribut

One solution that would go part way there is signed for browsers to only run signed javascript when it originates off site. Common libraries that are distributed via CDNs can be signed, and any javascript that ships with ads would have to be signed too. And any CA that signs too many malware (too many meaning more than one) gets their cert revoked.