A year or so ago I wrote IPFS-boot which allows serving webapps on IPFS while providing also an update path and without breaking content hashing:
https://github.com/rhodey/IPFS-boot
But now if you want to serve a secure webapp and not use IPFS IMO the only option you have is to tell users to install Tailscale and to host the webapp themselves and then to install Tailscale on all devices.
If you want to reference resources securely, https://developer.mozilla.org/en-US/docs/Web/Security/Defens... is available and widely supported.
The deal here is Subresource Integrity will only help you if the index.html is considered trusted/authoritative. So you still need a way to get index.html to users and users need a way to say "is this the true index.html"
It kinda feels like the AWS or Azure of file distribution, so much stuff so confusing. Also apparently with Protocol Labs owning several of those things despite not operating those things?
Ironically seems quite a fragile setup.
Regardless, very sad news.
For anyone wondering, there are more sustainable (with a viable, focused business backing the project) options to do p2p, namely Iroh - https://www.iroh.computer/ which was built by ex-IPFS ex-Protocol Labs devs (I have no relation to the team beyond having worked with them back in the day).
Sadly Protocol Labs is doing.. ehh whatever now, except apparently supporting the projects it got its VC/crypto funding from.