There's nothing in the issue about it being "hijacked", the cert that is being presented by the CDN is not accepted by browsers, since it doesn't have the jsdel

There's nothing in the issue about it being "hijacked", the cert that is being presented by the CDN is not accepted by browsers, since it doesn't have the jsdelivr host listed as a SAN. It's just broken, at the CDN.