Very interesting. I didn't know about `crossorigin=anonymous` and `referrerpolicy`. You wouldn't believe how many "privacy-focused", "E2E encrypted", etc. web apps are just blindly loading things from multiple CDNs with no SRI and no CSP (let alone anonymous CORS or no-referrer).

Speaking of CSP, should it be in this list? It allows you to whitelist scripts that run on your page, prevent 3rd-party scripts from loading media, and act as a kind of application firewall with `connect-src`.