The signed exchanges protocol requires that the content be signed with a key with a short expiry date (< 1 week), sites are free to make it shorter. In extreme

The signed exchanges protocol requires that the content be signed with a key with a short expiry date (< 1 week), sites are free to make it shorter. In extreme cases, the providing site could sign with an expiry of < 1 day or even something like 1 hour. And iiuc, sites are still free to revoke their certs. So this is actually probably more secure compared to something like https in that regard. [0]: https://github.com/WICG/webpackage/blob/6cc3237b36c2f9ce75343d1ad39d7f138f07c87f/draft-yasskin-http-origin-signed-responses.md https://github.com/WICG/webpackage/blob/6cc3237b36c2f9ce7534...