This isn't a finished blog post yet, so bare with me. In http://jimkeener.com/posts/http http://jimkeener.com/posts/http I have two things which I think would

This isn't a finished blog post yet, so bare with me. In http://jimkeener.com/posts/http http://jimkeener.com/posts/http I have two things which I think would be great additions to both HTTP and HTML. The first are Content-Signature (signed with the TLS key perhaps)and Content-Hash (format: "hash-algo base64-hash-value") headers. The second is allowing a hash and/or signature attributes on elements that have a src attribute. This would allow the UA to check if the file is already cached (across domains perhaps too, though I'm not sure how serious collision attacks would be) without having to check the server. EDIT: I feel that these two features, in combo, would allow for a more secure method of using CDNs for things such as javascript libraries. They would also allow a better fallback method for loading local resources than what is used now. <script src="//ajax.googleapis.com/ajax/libs/jquery/1.2.6/jquery.min.js"></script> <script> if (!window.jQuery) { document.write('<script src="/path/to/your/jquery"> <\/script>'); } </script>