Comment by dylz

You have no guarantee that the server won't just "if (ip === companyName) { don't serve CSP + serve infiltrated JS }" in the future.