I've been wanting this for a while now. The common argument against this is that this enables cache poisoning attacks where an attacker can craft malicious files with matching hashes. But I think the security it offers against CDNs turning rogue makes it worthwhile. Here's the draft proposal https://github.com/pwnall/script-digest