I've been thinking about this problem for Airborn OS. In my opinion, the best place to put signatures of the "main resource" would be the website's certificate. [1]

I created a Firefox extension that can check signatures both in the certificate and (in the meantime) hardcoded in the extension. [2]

[1]: http://blog.airbornos.com/post/2015/04/25/Secure-Delivery-of...

[2]: http://blog.airbornos.com/post/2016/02/23/The-first-web-appl...