I've often thought about this when including eg. style sheets and JavaScript for Bootstrap (or any other highly popular .css and .js file) in HTML: every time I have to get the URL for the file in question. And I have to trust that this URL is reliable, and continues to be reliable.

It would be a lot easier if I could just specify the SHA-256 hash of the file in question, like so:

    <link rel="stylesheet" href_sha256="f0fa7e4b0123ff9618fc51f1e54c0842072605412113a6daaf23758c67952d0c">

instead of the current solution:

    <link rel="stylesheet" href="https://netdna.bootstrapcdn.com/bootswatch/3.0.0/flatly/bootstrap.min.css">

Specifying the hash allows the browser to retrieve this file from the quickest source, whether that be the global cache (maybe I visited some other web page that used the same file), or the browser knows a list of CDNs that have the file, and fetches from the fastest one.

It avoids having to specify the source of the file. As a developer, I really don't care where the file comes from -- I don't particularly want it to be sent from netdna.bootstrapcdn.com, but there's not sane standard to specify otherwise.