that can help notice a compromised CDN, but not a compromised server.
Not sure I understand the distinction, a CDN is a server, so if OP is hosting code to execute on their server, they would be checked by whatever has already been downloaded and run locally before, i.e a PWA
If the hash is permanently stored in the browser, that is better, but there are also browser updates
I'm rather sure that localStorage persists over browser updates so that can be "permanent enough"
to say nothing of exploits.
I mean... sure but at that point the same apply to native. If you can't trust the running environment you are screwed anyway.
Psychologically speaking I think about the situation as
So... yes in fine it's the same, i.e "more hoops" to go through to do the same things, BUT when framed positively it's genuinely more exciting, more empowering!