The <link> could include a secure hash of the package contents -- so that it could be loaded from a less-reliable or less-trusted channel than the referencing page. (For example, small page from uncacheable HTTPS, bulk package from edge-cacheable HTTP or P2P.)