You can use subresource integrity in the script tag which uses a sha hash to confirm the script is what is designated in the html. However, the html could be changed in transit so the only real way this can work is if you do that AND expose the sha hash to the user who has the last known valid sha hash locally that they can manually check against. It's not pretty, but it works.

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...