There's been attempts to standardize a way for a HTTPS server to say "Yes, this response really did come from me", but nothing has been really adopted. https:/

There's been attempts to standardize a way for a HTTPS server to say "Yes, this response really did come from me", but nothing has been really adopted. https://www.rfc-editor.org/rfc/rfc9421.html https://www.rfc-editor.org/rfc/rfc9421.html https://httpsig.org/ https://httpsig.org/ Without the server participating, best you can do is a LetsEncrypt-style "we made this request from many places and got the same response" statement by a trusted party. Inspiration: roughtime can be used to piggyback a "proof of known hash at time" mechanism, without blockchain waste. That lets you say "I've had this file since this time". https://www.imperialviolet.org/2016/09/19/roughtime.html https://www.imperialviolet.org/2016/09/19/roughtime.html https://int08h.com/post/to-catch-a-lying-timeserver/ https://int08h.com/post/to-catch-a-lying-timeserver/ https://blog.cloudflare.com/roughtime/ https://blog.cloudflare.com/roughtime/ https://news.ycombinator.com/item?id=12599705 https://news.ycombinator.com/item?id=12599705