That's kind of the idea. The hash would be there so the browser could verify it is what is expected. Assuming the source page is delivered via HTTPS (w/ compres

That's kind of the idea. The hash would be there so the browser could verify it is what is expected. Assuming the source page is delivered via HTTPS (w/ compression disabled :D) then the client could verify the hash against what it received to confirm it's valid.