That's a fair point. I hope you're involved in the spec discussions around these topics! There's definitely room for improvement in terms of ease of use. I not

That's a fair point. I hope you're involved in the spec discussions around these topics! There's definitely room for improvement in terms of ease of use. I noticed this update on the https://web.dev/coop-coep/ https://web.dev/coop-coep/ article recently: > We've been exploring ways to deploy Cross-Origin-Resource-Policy at scale, as cross-origin isolation requires all subresources to explicitly opt-in. And we have come up with the idea of going in the opposite direction: a new COEP "credentialless" mode that allows loading resources without the CORP header by stripping all their credentials. We are figuring out the details of how it should work, but we hope this will lighten your burden of making sure the subresources are sending the Cross-Origin-Resource-Policy header.