> (albeit with cryptographic signing to ensure it actually came from the right host). This might be dead in the water, yes. Which is a pity, because this could

> (albeit with cryptographic signing to ensure it actually came from the right host). This might be dead in the water, yes. Which is a pity, because this could have been extended into a way to allow browsers to pin a specific version of a web app and warn the user if the server sent something different the next time they visited. Having a TOFU security policy for web apps would have made them roughly comparable to native apps for certain threat models, especially considering that native apps often auto-update without giving the user a meaningful chance to check whether the update is backdoored. For both web and native apps, though, it would be nice if there were independently run Binary Transparency logs published so that apps would only download an update whose source code had been publicly available (and reproducibly buildable) for some reasonable amount of time to allow an audit to occur.