I don't understand why my browser allows this:
<script src="https://www.google.com/recaptcha/api.js"></script>
but not this:
<script src="https://www.google.com/recaptcha/api.js" integrity="..."></script>
The latter fails due to CORS. Why do I need google's (or any server's) permission to verify that they haven't changed their script on me? Seems backwards. File integrity should be 100% client side and not involve the server at all.