That's kinda what IPFS is - every webpage is identified by its hash. But then updates are impossible so IPNS steps in to give a mutable name -> hash relationshi

That's kinda what IPFS is - every webpage is identified by its hash. But then updates are impossible so IPNS steps in to give a mutable name -> hash relationship. Just like a git commit, if you have the IPFS hash you are guaranteed for it to be correct. How you find that hash - IPNS or some other method, has been the major challenge. Further we used to have HPKP to further protect the security chain but it ended up being dangerous for various reasons. Monitoring certificate transparency logs for any re-issuences of your domain's certificates is the current detection method as http is pretty heavily penalized in todays browsers.