Replying to @yoavweiss and @JibberJim, @AmeliasBrain
Signature-based SRI would be great; but to be honest if embedded third parties were forced to communicate with us when they update their code (and explain what the change is to motivate us to upgrade) that would be a feature. A big feature, actually.