If it were me, I'd make third-party font sources require a SHA hash. In pseudocode:
url("https://fonts.googleapis.com/comic-sans", sha="abcd1234")
This way:
- If my browser has comic-sans cached, no request is made
- Caching works even if the same resource is sourced from multiple places (e.g. I can host comic-sans locally, but if they got it from a CDN, they don't need to get it again)
- If a malicious site replaces a resource, that's flagged
I think the trick would be to make this optional (but bandwidth/privacy-saving), and gradually to make this increasingly mandatory for different types of resources. AJAX calls obviously can't have SHA hashes, but JavaScript libraries can.
- If my browser has comic-sans cached, no request is made
- Caching works even if the same resource is sourced from multiple places (e.g. I can host comic-sans locally, but if they got it from a CDN, they don't need to get it again)
- If a malicious site replaces a resource, that's flagged
I think the trick would be to make this optional (but bandwidth/privacy-saving), and gradually to make this increasingly mandatory for different types of resources. AJAX calls obviously can't have SHA hashes, but JavaScript libraries can.