All of that can be achieved with CSP headers. But I think browser vendors will ratchet up their rhetoric and claim it's still unsafe and must be warned about be

All of that can be achieved with CSP headers. But I think browser vendors will ratchet up their rhetoric and claim it's still unsafe and must be warned about because someone may learn which site a user visited.