I'm currently implementing a couple of security improvements to a crypto currency trading website that handles all data client-side and uses a static file approach.
One of the things I've been asked to do was to add a mechanism to allow users to check whether the page had been modified by a third-party server-side. Please note that I'm not referring to server<->eve<->client-type tampering, as CSP, HSTS and other protections are in place.
My first approach to this was to sign every file with a private key (that never gets into prod servers) and distribute the public key using a different channel. The signed hash would then be hosted in the same directory as the file, with the filename being something like .key. Alternatively, all files could be hashed and signed in block. The checks would have to be manually performed by the user (this is not an issue).
I know a server watchdog can be used to check for file-changes, but from what I understood the hosting conditions are extremely volatile.
Finally, I'm not allowed to create a standalone app for this.
Is this reasonable? Is there any proposed solution to this request?