What is 'Subresource Integrity' (SRI) and what attack does it prevent?

• A.SRI validates that the server's TLS certificate is trusted before downloading resources
• B.SRI prevents the browser from loading resources from HTTP (non-HTTPS) URLs
• C.SRI allows HTML to specify a cryptographic hash (sha384) of a script or stylesheet. When the browser fetches the resource, it computes the hash and compares it to the integrity attribute. If they don't match (i.e., the CDN or resource was modified), the browser refuses to execute/apply it. This prevents CDN compromise attacks: if an attacker modifies a CDN-hosted jQuery file, browsers with SRI reject the tampered version
• D.SRI is only applicable to scripts, not stylesheets or web fonts