Yeah, also thought so, but here it says "and file:// URLs are also considered to have been delivered securely." (https://developer.mozilla.org/en-US/docs/Web/Security/Secure...). Am I missing something?

Hmm, I must have misread that paragraph based on my expectation.

But you're right. Just tried it and it told me:

"Uncaught (in promise) DOMException: Public-key credentials are only available to HTTPS origin or HTTP origins that fall under 'localhost'. See https://crbug.com/824383"

Unfortunate :/

Some dirty solution can be spinning up home server just to download web app to your device and let service workers cache everything relevant. And then turn off server to prevent any updates to app.

This is of course not very user friendly, but might have some use, if you can't or don't want to have running server 24/7 at your home or secure location.

But I don't know, if any browser will let offline apps live for indefinite time.

I was even playing with code signing web apps with help of service workers, which was not bullet proof, but better than nothing. Ultimately it failed on the fact, that you could not prevent/cache/block update of actual service worker file.

Another dirty workaround could be using dynamic one time address for serving service worker only on first attempt and then browser would get 404 on attempts to update service worker. Again, not very useful as you are at mercy that browser won't just purge such "broken" worker.

Another idea would be to use https://redbean.dev/ . For mobile it'd not work, though.