[litewulf]

ETags can be arbitrary, the server can put whatever it wants.

[jbert]

Ah, yes. An attacker could fetch the resource themselves, discover the ETag and serve their malicious resource with the real ETag. Sorry.