While Google may have less than charitable motives for pushing Signed HTTP Exchanges, the standard could end up being a way to secure web apps against compromis

While Google may have less than charitable motives for pushing Signed HTTP Exchanges, the standard could end up being a way to secure web apps against compromised hosting. If you could pin a specific version of a web app, and make sure that it appears in a public transparency log, that would give web apps roughly the same threat model as desktop apps. https://tools.ietf.org/html/draft-yasskin-http-origin-signed-responses-08#appendix-A.4 https://tools.ietf.org/html/draft-yasskin-http-origin-signed...