As long as you use subresource integrity we have a deal! I know it's currently experimental but having native browser support is much more palatable than using JS to check the hash.