[ufo]

The point they were making is that googleapi and code.jquery.com don't count as trusted (at least not until you verify the hash)

[nly]

The domains are obviously trusted to a degree. The objective of the hash is just to allow a content addressed[0] clientside web cache, and avoid talking to them most of the time. Good for privacy, security and load times.

[0] http://en.wikipedia.org/wiki/Content-addressable_storage