Regarding an "update path", GNS has support for that built-in; though I've not been able to try it myself, since I can't get GNUNet to bootstrap :-(
For a real world example of a hybrid approach that works see bittorrent where torrents can optionally contain urls that point to alternate download sources in order to speed up the initial seeding phase.
If you want to reference resources securely, https://developer.mozilla.org/en-US/docs/Web/Security/Defens... is available and widely supported.
The deal here is Subresource Integrity will only help you if the index.html is considered trusted/authoritative. So you still need a way to get index.html to users and users need a way to say "is this the true index.html"
Edit: Okay, so a couple of people have downvoted but no-one has answered.
Why would you use tailscale to secure a web app?