We may want to consider some way to serve the app's HTML with Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp to enable crossOriginIsolated. Since this could potentially break clients, we at least need an opt-out, or perhaps it should be opt-in, or based on your configuration. We will at least need this for skwasm, since it depends on a crossOriginIsolated browser context to use multi-threaded wasm.