Edit: This article describes a solution that uses an appcache manifest with a far-future max-age that stops the browser from refetching the application code. It then uses an alternative mechanism to load updates presumably with a future option capable of verifying the legitimacy of the code with some sort of public key infrastructure ala Microsoft's Authenticode.
http://substack.net/offline_decentralized_single_sign_on_in_...
Edit: This article describes a solution that uses an appcache manifest with a far-future max-age that stops the browser from refetching the application code. It then uses an alternative mechanism to load updates presumably with a future option capable of verifying the legitimacy of the code with some sort of public key infrastructure ala Microsoft's Authenticode.