I always wonder if there is value in extending the HTML spec to include contracts in webpages for 3rd party calls. Might help enforce a domain level policy by a domain owner making sure content creators have to oblige.

Exactly the reverse of the cross-origin request header.