Inline scripts, CSP, and SRI

[devd]

If CSP whitelists a hash, an inline script with that hash or a remote script with that hash in its integrity attributes are both signed. If a CSP whitelists a public key, can we figure out a way to get it to work with inline scripts? Can we reuse the integrity attribute somehow? Or do we need a new attribute?

[mikewest]

I'd continue punting on this for the moment. Let's work out how we do things in HTTP, and then determine how to apply that to HTML.

Guessing wildly, if we end up running with the model in #16, we'd add some attributes to a script block that allowed the expression of a signature over that block, and keep the key in the integrity attribute as today? Maybe? Later. :)

[yoavweiss]

I agree with the "later" sentiment. It'd be great to see actual deployment use cases before investing efforts in this direction.