> Even doing it on a CLI doesn't help since the server might deliver something else to the browser. That is indeed one of the hurdles I encountered, ideally th

> Even doing it on a CLI doesn't help since the server might deliver something else to the browser. That is indeed one of the hurdles I encountered, ideally the browser itself should be in charge of verifying these claims (resource integrity helps in this case). > And if you have dynamically generated HTML then you can't really authenticate it either. In the case of SSR/PHP/other means of backend-generation of HTML, yes. I initially limited the PoC to SPAs and deterministic JS bundles. > Also, how do I trust the revelio.json? There's no signature. For now, as I said it's a work in progress, but indeed a way to authenticate the tamper-proof properties of the manifest is necessary. This however brings up the issue of a chain of trust, which is what apparently Tanker is trying to provide with their product. Yet, it raises the question: why should they be trusted ? The commercial viability argument (we don't screw up to stay in business) is not enough IMHO, trust should be based on mathematical proofs, not business rules.