I learned something new today! For others looking, here's the spec which describes this - https://w3c.github.io/webappsec-subresource-integrity/#does-response-match-metadatalist