And yet, jsquery works that way, doesn't it? Everyone pulls jsquery in from basically one site...

Does the entire website have to be on that separate third party location, or just a self-booting kernel of crypto to enable a signed website to be downloaded from the desired source?