Seems like a good case for a strict content security policies and self hosting static assets.