But what would be the point? Why would you load code over HTTPS if you're going to make it static anyway? If the code can't change dynamically, then you might as well put it next to the JS file on the filesystem.
I think this is a terrible idea that can only end in misery but I can understand why they don't add integrity validation by default.
I think this is a terrible idea that can only end in misery but I can understand why they don't add integrity validation by default.