Comment by manmal

The mechanism you are describing is already implemented and advertised: https://webkit.org/blog/10882/app-bound-domains/

Apple „just“ need to enforce it.