I'm not saying that it's a replacement for HTTPS. Nothing stops you from using SRI hashes for HTTPS content. If you're concerned over censorship, you should be using HTTPS, period. SRI is more concerned about bad CDN content. Your CDN can use HTTPS, but your server's page says what the hash should be, so if your CDN goes rouge, things will start breaking.