Yeah but you, the developer, need to provide the hash of the script being downloaded, work that’s easy to miss.

In case the hash is provided, caching across websites could be turned on again, to avoid the possibility of it being used as a supercookie. The website would have to know the hash of the supercookie before loading the resource. Except if a candidate set of possible users can reasonably be downloaded to the client, maybe sorted by time of last access and proximity to the geo location of the IP address of the last access...

Yes. Pretty much.