Also, maybe the user should be able to initiate offline mode for a single page.
The developer can still change the HTML file, but if they change the script it's easy(ish) to observe that the hash has changed.
GitHub recently introduced[1] an "artifact attestation" system, which is essentially a way to demonstrate that a particular build was built by a particular source tree (although the precise security properties are more subtle than I've summarized here). Combining these two things and writing a static "load the most recent version and verify its integrity" script could be interesting.
[0] https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
[1] https://github.blog/2024-05-02-introducing-artifact-attestat...
The first step along the way though is making actually secure web apps possible.
Aren't secure web apps already possible? Well, Signal among others thinks otherwise. See the Isolated Web Apps explainer for a full explanation https://github.com/WICG/isolated-web-apps
Because nothing is stopping this app from updating its code after a few weeks in order to begin shipping data.
Of course, you can download the page and then use it off-line. Sure. But it'd be nice for a page author to communicate "I'm good, this page is self-contained and doesn't need any further access to the network, please let the user know."
Allowing a user to "pin" that status would similarly be great. Oh, and apply that or make it available to browser extensions.