I think most of that could be achieved by a bunch of CSP rules that disable various features. No frames, no 3rd-party js, various request types restricted to sa

I think most of that could be achieved by a bunch of CSP rules that disable various features. No frames, no 3rd-party js, various request types restricted to same-site and data: URIs. Don't grant sandbox: allow-same-origin and the site will be a unique origin on each visit, thus effectively disabling cookies. So it's already possible to achieve quite restricted subsets of what a website can do. The issue is agreeing on what subset is useful enough for many sites.