[dboreham]

There are already tools and techniques to validate served JS is as-intended, and these techniques could be beefed up by adding browser checks. I've been surprised these haven't been widely adopted given the spate of recent JS-poisoning attacks.

[bawolff]

You mean like SRI? That's not really what happened here, so its not really relavent.