> Without fingerprinting/certification of the entire javascript-source the server > could serve a manipulated source code that exfiltrates data This is actuall

> Without fingerprinting/certification of the entire javascript-source the server > could serve a manipulated source code that exfiltrates data This is actually one of the described use cases of the new webpackage specification: https://tools.ietf.org/html/draft-yasskin-webpackage-use-cases-01#section-2.2.3 https://tools.ietf.org/html/draft-yasskin-webpackage-use-cas... Here is the current draft: https://wicg.github.io/webpackage/draft-yasskin-dispatch-web-packaging.html https://wicg.github.io/webpackage/draft-yasskin-dispatch-web...