I agree the thing serving foo.js should be setting its sha hash in the headers. The client can validate that the header hash and the actual contents match, if

I agree the thing serving foo.js should be setting its sha hash in the headers. The client can validate that the header hash and the actual contents match, if it so desires. On the web application side, by putting a "sha" tag in the script tag, the app is saying, "Fail if foo.js isn't the one I expect, regardless of where it comes from." By putting a "shared_cached" in the script tag, the app is telling the client where it is allowed to look for and to put foo.js. Finally, a client should be able to ignore any shared cache requests and make everything private at the user's request.