If accompanied by the exact same sha-256 hash idea, loading from any external source cannot expose the user to any additional risk.<p>SHA + CDN url list (for whitelisting&#x2F;reliability purposes - public&#x2F;trusted, and then private for reliability) would be ideal.