webcat

I think one of the growing threats lately in the community has been over malicious client-side javascript, especially when the client handles end-to-end encrypted content (used on sites like Proton, MEGA etc.), so requiring users to trust Google with the contents of these client pages, and by extension the emails themselves, seems (in my opinion) to defeat the entire point of this feature. Some work in this area has been done in the form of browser extensions that are used to verify signed assets delivered to the client: https://github.com/freedomofpress/webcat https://github.com/tasn/webext-signed-pages https://github.com/jahed/webverify https://github.com/facebookincubator/meta-code-verify But unfortunately for now, none of these are seeing wide adoption and this remains an unsolved issue. It also does not require anyone to use known-go

Possibly https://github.com/freedomofpress/webcat? (I also made one, a long time ago: https://github.com/twiss/hcs-checker-firefox.) There is also an effort to build this into browsers directly, which we (Proton) are involved with: https://github.com/twiss/source-code-transparency (old initial proposal) https://github.com/beurdouche/explainers/blob/main/waict-exp... (more recent proposal) https://github.com/beurdouche/w3c-waict/blob/main/waict.bs (very early draft specification)