Devin Mullins

OK, looked into the various sha256s. I think all can be omitted except `5Cxq...` and `UXYp...` which are for the onerror handler, pre-and-post mod/nomod, respectively.

> Also, the page needs to be updated to advise on sending a `Content-Security-Policy` HTTP response header rather than a `meta[http-equiv="Content-Security-Policy"]` since the latter is invalid AMP, yeah? Oh oops,...

Prewarming is secondary (to me) to the cache key, but AFAICT the Variants spec designs for both use cases. The endpoint server specifies a [list of variants](https://httpwg.org/http-extensions/draft-ietf-httpbis-variants.html#name-the-variants-http-header-fi) it serves (both...

I should add: I don't mean to advocate for Variants in particular (at least not in this thread). But I think it's a useful reference, as the "two things" necessary...