That doesn't make sense since any content loaded from a second site has the ability to compromise the first. If nobody said that, they weren't thinking hard eno

That doesn't make sense since any content loaded from a second site has the ability to compromise the first. If nobody said that, they weren't thinking hard enough. Browsers already have this kind of transitive security enforcement -- you can't load a page with TLS that then pulls JS via plaintext http.