I'm not a fan of this approach. XSS attacks tend to involve attackers coercing servers into generating JS that act against the server's interests; since the server is signing the JS, the fundamental weakness remains. Moreover, by disabling inline scripts, this tool forces dynamic JS behavior to be factored into bona fide dynamic Javascript files, and actual JS is an even harder quoting domain to deal with than the HTML DOM.

We are already moving towards a world where XSS is largely a solved problem: where servers can do content-aware neutralization of all content by default. Rails 3 is already getting close. Over the long term, this is how we're probably going to deal with the XSS problem.