Sample webapp that after the first load ensures that no resources are loaded that aren't signed by a specific GPG key