Almost nobody actually cares about graceful degradation these days.
I find this happens with a lot of news sites. It's hilarious that a website made primarily for displaying text is absolutely defeated by turning off javascript.
NPR text only: https://text.npr.org
And although not news, Facebook has a secret no-Javascript version here: https://mbasic.facebook.com
I think you could quite sanely track a few sites, maybe the top 200 or 300... after that it'd get unwieldy.
And, for fun, on the other side I believe a few years ago google's in house public hosting of jQuery received a bad push and was serving a tainted package for a while... even the good actors can mess this up.
A peer vetting system might work well (like DNS) but it'd need a lot of careful thought.
For less popular sites, the user can add it manually, or the site operator notices their site is broken for increasingly many users and stops linking scripts from other domains.
> And, for fun, on the other side I believe a few years ago google's in house public hosting of jQuery received a bad push and was serving a tainted package for a while... even the good actors can mess this up.
That's an independent problem. You could have the same thing happen for actual first party scripts.
And in this context if they're really good actors then they fix it as soon as it's discovered, and if they're not then you take them off the approved list.