AFAIK bundles are designed to enable Google's CDN to serve up signed bundles from their servers and masquerade the bundles as coming from your site's domain. That's not something MHT files were designed for. (This actual feature is separate.)
The key would probably have to be delivered in-band, requiring a TOFU security policy, but that's not so bad.
Ideally the browser would also keep track of which version of the app it loaded last time, and give the user the option of fetching a newer version if one is available, to prevent malicious updates.