You've misidentified the problem. We need CDN solutions for front-ends because that's the best way to deliver great, scalable performance for complex SPAs. We

You've misidentified the problem. We need CDN solutions for front-ends because that's the best way to deliver great, scalable performance for complex SPAs. We also need a purely client-side flow for mobile (native) apps. Additionally, the authorization code flow (with PKCE) in Keycloak still supports pure client side authorization. Its more complex than the implicit flow, but it doesn't really matter as any library (including keycloak-js) will take care to ensure its done correctly.