So basically we can give up HTTPS for origin authentication (leave it for encryption/privacy) assuming the bundles are all signed?