Hacker News Reader

The script tag could have a mandatory file hash attribute.

Then you would need to know the (dynamically generated) contents in advance?

The server generates the content, so he knows the file hash in advance.

What's to prevent the server from sending you a unique hash?

How would he know that it's "you"?