I think CSP shows self regulation doesn't work in practice. At least not without incentives which don't currently exist. Therefore it's more practical to put c

I think CSP shows self regulation doesn't work in practice. At least not without incentives which don't currently exist. Therefore it's more practical to put control in the hands of the user agent.