What about an alternate for these 'platform script includes' like Twilio and Stripe:

    <script src="..." report-integrity="https://cdn.stripe.com/report">

in which clients compute the integrity and asynchronously ping a lightweight payload of the integrity to the third party? You would then seed your report service with a list of known hashes and set up alerting for when new hashes were observed.