One thing that I neglected to mention is that since the SRI hashes are calculated, previews can be cached by peers other than the originating host - since they are verifiable, anyone can pass them along and the client can verify the payload.

Not something I really fleshed out in discovery, but if there is interest, that might make it more production ready.