[xtrapolate]

> "SRI has been available for two years and it still isn't being used enough."

Two years is relatively fresh. There's probably a significant amount of customers with browsers that don't support this.

Can't we just implement a simple poor-man's SRI ourselves? Download the 3rd-party script, hash it, check hash, proceed to exec() if all is well? This should be supported by much older browsers.

[jmngomes]

Actually, IE and iOS Safari are lagging but other major browsers seem to have support for SRI for quite some time: https://caniuse.com/#search=sri