Re: [integrity] content-addressable cache?

> Seems that if you could inject a hash there, you could have script
> injected either way. So seems likely that would be safe. But does that
> mean we'd require CSP to make use of this bit of SRI or that if CSP is
> enabled you need to do this?

I think you wouldn't require CSP for cases where CSP is not enabled since injection (without CSP) can already result in an equivalent attack (i.e. you can XSS).