Bootloader.js loads your static resources securely. It checks for cryptographic signatures on everything it loads. It caches itself permanently, so that an adversary serve existing clients a bad version of bootloader.js