If the entire system lives in a browser extension, you're doing what I said in the comment at the top of this thread --- and why would you bother "loading" anything from the server at all? If you know the hash, you know what the file is supposed to be.

Otherwise, almost every rendezvous you have with the server is an opportunity for methods to be rebound and your cryptosystem to be subverted. If you don't see how, it's a good exercise to investigate.