Re: [packaging-on-the-web] What's the origin of a signed package? (#24)

That quote isn't accurate to the world today. It's looking more and more like Suborigins will allow at least some form of permissions, to be determined exactly how. So, yes, Suborigins might help. You can check out my latest draft of the spec to get a sense of what's going on: https://metromoxie.github.io/webappsec/specs/suborigins/index.html

---
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/packaging-on-the-web/issues/24#issuecomment-75151778