I’m building a Worker that deals with sensitive PII, and it would be great if my customers could verify that my service is doing what they expect with their data.
A simple way to achieve this would be an option for the Workers runtime to include a header containing a hash of the code responsible for serving the response. (It would also be necessary for the runtime to always strip that header if any Worker script attempts to set it.)
That way, if I publish my code on workers.dev, a customer or other third party has everything they need to verify that their requests are being handled by the published code.
