Post

Signature-based SRI is being spec'd right now: wicg.github.io/signature-ba... This will be useful for many use case and become relevant for PCIv4 compliance which requires assuring the integrity of sourced scripts (6.4.3). Please chime in and share your use cases: github.com/WICG/signatu...

On the plus side, one of the limitations of SRI was third parties adding random content (see swag.cispa.saarland/papers/steff... final table). However, SRI in its current form protects including sites from a full compromise, whereas this assumption is being relaxed if there are signatures involved.

Indeed signatures have different security properties, but since trusting a signature is an opt-in feature, I'm not worried about this.