I really like your first proposal. The second one is good too, but less pressing to me than the first. The software I'm working on uses static JS with a high se

I really like your first proposal. The second one is good too, but less pressing to me than the first. The software I'm working on uses static JS with a high security requirement, and is meant to be deployed on any host. Integrity guarantees would be valuable for that.