Comment by EGreg

Well, you can just use a service worker, instead of broadcast channels or shared workers. They have all the functionality you need, now.

Any iframe that loads in a secure context and itself creates a secure context, can load a service worker for its domain or subdomain or path.