&gt; Not that any of this will ever be deployed[2], because they&#x27;re two of the most invasive defence measures [...]<p>SRI is going to be a tough sell. CSP, not so much.<p>Case in point: within two years, HSTS use by Swiss Banks has gone from 0% to 40%. I managed to get the first deployment up and running, and at this point we made it into the preload lists. If just one company gets any of this stuff up and running (and whomever did it keeps pestering their colleagues at some others about it), adoption is possible.<p>Right now I&#x27;m working on getting some traction with HPKP and CSP. HPKP is going to be challenging as doesn&#x27;t offer protection against user-installed (or malware-installed) root certificates, but seeing how the cost of adoption is low, it shouldn&#x27;t be impossible.<p>CSP should be easier. Being the responsible bank we are, we aren&#x27;t dropping any javascript files from CDNs into our pages. Anything running in our domain originates from there, so it&#x27;s basically down to starting with -Report-Only, unsafe-eval and unsafe-inline options and gradually moving towards *-src &#x27;self&#x27;. And it provides valuable protection against all sorts of Adware and Malware.<p>Ping me in a year. I&#x27;m confident we&#x27;ll get there by then.