3 ms·

My understanding is Signed Exchanges only solve "I want to allow another server to handle requests for my HTTPS server" and not "I want to guarantee the integri

My understanding is Signed Exchanges only solve "I want to allow another server to handle requests for my HTTPS server" and not "I want to guarantee the integrity of content coming from my HTTPS server". Did they expand the spec to somehow address the latter?

modeless 6y ago
You could obtain an HTTPS certificate and then only use it for offline signing. That would fulfill the same purpose.
- fabrice_d 6y ago
  But the platform would not know that this is a code signing certificate - unless something specific is designed.
  - modeless 6y ago
    HTTPS certificates are already treated as a kind of code signing certificate by browsers.