I just noticed today that https://html.spec.whatwg.org/#prepare-a-script step 21.6 passes in the integrity metadata for classic scripts but not module scripts.

Maybe this is intentional, because it's not super-clear which of the fetched scripts in the graph it would apply to? For example, nonce="" and crossorigin="" apply to everything in the graph, so maybe it'd be weird to only apply integrity="" to the top-level script? I dunno if that reasoning is sound though...

If this is intentional, we should add a note clarifying.