I would like to use a CDN for the static content of a website. But obviously I do not wish to share my SSL key with any external service. What are my options?
An ideal solution would be to link to unencrypted static content but enforce (!) that browsers authenticate this content, for example by checking that it matches a hash. I imagine including this hash with every static link. But can it be done? I do not want to trigger a mixed-content warning, and I also do not want to open a security hole by either not authenticating static content or by giving the CDN the ability to sign anything with my key.
Can this be done? If not with current browsers, what needs to be done to make it possible?