I wonder if they’ll eventually hide the URL path from extensions (for security) and serve ads off google.com. Even serving ads from somewhere under google.com/amp would probably cause problems for ad blockers. Or maybe extensions see the rewritten URL only, so CanSignHttpExchanges is a way of changing third party trackers and ads into first party.

Also nice to see DigiCert helping them out, but I’m not surprised with how DigiCert’s product lineup isn’t much more than a test of how much of a sucker you are.