The page should provide a hash, no need to ping a server, just a local cache lookup (like per-site cache schemes now) then a user-selected choice of downloading from the first-party, or an ordered list of third-parties.
The local cache is, unfortunately, also an unintended source of fingerprinting and cross-origin communication.