@poledesfetes What security headers are you
talking about? We rely on package-lock with checksums today and in browsers on
subresource integrity, so this is already a solved issue today.