I think the next step is we force the JS through a halting verifier a-la BPF and fake all the fingerprinting API's. The browser vendors are not going to do it, and they cant be trusted anyway.

And stop sending the user-agent.