Cross-Origin-Embedding-Policy?

Hey folks,

We've mentioned the discussion around Spectre mitigations like
`Cross-Origin-Resource-Policy-Policy` in a few of our previous calls, and
pointed to the conversation at https://github.com/whatwg/html/issues/4175
 specifically.

I've tried to coalesce that discussion down to a monkey-patch doc that will
eventually turn into PRs against HTML and Fetch:
https://mikewest.github.io/corpp/.

Y'all's feedback would be welcome! Either here, or in bugs filed against
HTML (which we'll bundle up under the "
https://github.com/whatwg/html/labels/topic%3A%20cross-origin-embedding-policy"
label.

Thanks!

-mike