[CSP] Consistency of CSP hash-source with SRI regarding secure origins

I have two questions regarding CSP hash, particularly for the people that
are concerned about the use of SRI for non-secure content:

1. What distinction, if any, should be made between the policy for CSP
hash-source vs. SRI for non-secure origins? Does Google Chrome implement
CSP hash-source for non-secure documents? Is the implemented behavior
intentional or accidental? Will it change?

2. Does anybody have any implementation experience to report, regarding the
use of CSP hash-source on non-secure origins? In particular, have people
found middleboxes tampering with their <script> elements in a way that
causes CSP violations due to hash-source?

It seems to me that SRI and CSP hash-source are quite similar to each
other, so it seems reasonable to have the same policy for both, regarding
the secure origins thing.

Thanks,
Brian