This is a step in the right direction for embedding external resources. It'd remove CDNs as an attack vector (once it's rolled out everywhere). It'd be great t

This is a step in the right direction for embedding external resources. It'd remove CDNs as an attack vector (once it's rolled out everywhere). It'd be great to come up with some kind of way to also tell the client what resources are expected, and if a new one is loaded (e.g. <iframe src="http://dangerous.malware.com"></iframe> http://dangerous.malware.com"></iframe>) the client would not even connect to it.