I do not agree to your assessment of "That means we can't use the integrity attribute.": SRI supports having multiple hash values to be provided as attribute value for "integrity". So, you could provide the hash values of all reasonably-used User Agent types there. The browser would automatically pick&choose the right one for you. It may get challenging, though, to find the proper superset of all possible values...