Async still prevents the DOMcontentloaded event from firing, and if you can’t sandbox JS into an iframe you’re screwed security-wise if the linked source gets owned or turns evil.