Clarify that integrity metadata must be non-empty

[bakkot]

There is a Note which reads

Note: Here, we verify only that the request contains a set of integrity metadata which is a subset of the hash-source source expressions specified by directive. We rely on the browser’s enforcement of Subresource Integrity [SRI] to block non-matching resources upon response.

But that's misleading: integrity metadata can be an empty set, which is a subset of every set, but that is not sufficient to meet these verification requirements.

For IPR I would consider this to be non-substantive.

---

Preview | Diff

[w3cbot]

sideshowbarker marked as non substantive for IPR from ash-nazg.