What would be the potential attack vectors if a browser were to ignore the certificates when making a network request that is verified via subresource integrity?
As an example, lets say I had the script tag:
<script src="https://example.com/my-script.js" integrity="..." crossorigin="anonymous">
The browser would make the request for
my-script, but wouldn't bother checking the certificate, as the validity of the script is verified by the integrity attribute.
The webpage that contains the script tag would still be verified via certificates, but the script itself wouldn't.
Are there any possible attack vectors in this scenario?