That's a very good idea. There's more stuff in that TR than is strictly necessary, but the basic idea is

    <a href="https://example.com/file.zip"
     integrity="ni:///sha256;  
     skjdsfkafinqfb...ihja_gqg?
     ct=application/octet-stream"
     download>Download!</a>

That provides integrity checking without encryption. It also helps with caching - rather than expiration times, cache systems can use the hash. If you already have a copy of jquery in cache and it matches the hash, it doesn't matter where it came from.