I'm requesting a TAG review of:

• Name: Signed Exchanges
• Specification URL: https://tools.ietf.org/html/draft-yasskin-http-origin-signed-responses
• Explainer, Requirements Doc, or Example code: https://github.com/WICG/webpackage/blob/master/explainer.md
• Tests: None yet.
• Primary contacts: @jyasskin

Further details (optional):

• Relevant time constraints or deadlines: We're hoping to do a Chrome Origin Trial by Oct/Nov 2018.
• I have read and not yet filled out the Self-Review Questionnare on Security and Privacy. The primary "yes"es are:
  • "Does this specification enable new script execution/loading mechanisms?" (since it allows a resource on one origin to provide script for another origin that signed it) and
  • "Does this specification allow downgrading default security characteristics?" (since signing an exchange allows an attacker to serve that exchange throughout its up-to-a-week lifetime, even if the server has fixed a bug since then).
  • The spec does have security and privacy considerations.
• I have reviewed the TAG's API Design Principles, but for example feature detection isn't fully worked out, and none of the eventual Javascript APIs are designed yet.

You should also know that...

The IETF's HTTPWG is also reviewing the specification.

It's not clear whether I get better feedback by mentioning that, among the other listed use cases, this allows AMP to fix its URL problem (which causes some people to stop thinking beyond "AMP is bad"), or not (which causes some people to decide I'm trying to hide something), so please pretend I did whichever helps you think more about the details of the proposal.

We'd prefer the TAG provide feedback as (please select one):

• open issues in our Github repo for each point of feedback
• open a single issue in our Github repo for the entire review
• leave review feedback as a comment in this issue and @-notify [github usernames]