> I'm not sure where it gets the known good hash from without making an HTTP call to the originating URL, though

Hmm, yeah. I was thinking about reducing the amount of data transferred but it's the actual number of requests that's the problem then it won't help.