This was solved for the case of http/https with the "Strict-Transport-Security" header which says that all future communication (for a certain time) will always

This was solved for the case of http/https with the "Strict-Transport-Security" header which says that all future communication (for a certain time) will always be over HTTPS. The browser could easily respond to similar "Strict-Signature-Security" header requiring all files to come with a Signature header in the future.