[Sanddancer]

So what happens when github goes down? I'd argue a better source for this sort of thing would be to put the hash in dns, either directly in a txt record, or using hacks involving A or AAAA records. Your nameserver almost certainly has more security than your github repo.

[eric_bullington]

That would be really sweet if you could access dns directly in client-side Javascript, particularly given the existance of DNSSEC (great for bootstrapping trust).

Alas, client-side JavaScript doesn't speak DNS. You'd have to go through a server, which would mean you'd lose anything you might gain.