Consider separating opaque-origin iframes from subresource loading

In https://github.com/WICG/webpackage/blob/master/explainers/subresource-loading.md#link-based-api , there is an idea of urn:uuid: URLs which can be present in the bundle, which will be treated as a new opaque origin.

I really like the idea of adding a new web platform feature that makes it easier to create an opaque-origin iframe. This seems genuinely useful for increasing isolation (potentially helping privacy), where there are often multiple units of code that need to be treated with different trust levels. Existing solutions do have problems:

• Blobs can achieve the same semantics, but require that all of the HTML be downloaded, and then put in a blob, and then in an iframe. This blocks important browser optimizations like starting the render before the whole network fetch is done.
• <iframe sandbox> can be used declaratively, without this overhead of indirection of storing to and loading from blobs, but its semantics are quite different. Sometimes you don't want these additional restrictions, and you just want an opaque-origin iframe.

At the same time, I'm skeptical of the API surface here being linked to URLs inside bundles, for a couple reasons:

• It seems like opaque-origin iframes are useful outside of bundles (and in omit-credentials contexts), even if there are some use cases where it is useful to load their HTML from a bundle.
• There are some annoying edge cases that would have to be defined one way or another, e.g., if multiple bundles define the same UUID.
• There is a kind of "semantics" that the URL has--e.g., you can see which origin it comes from--which is more visible if it's not mapped through a UUID.
• There's no way to map loading these opaque URLs to an "underlying" URL for potential verification, as suggested in #551

I want to suggest that, rather than defining UUID URLs to make opaque-origin iframes, a separate attribute is used in the iframe tag, to make the origin opaque, regardless of what the src is. For example, we could call it <iframe opaque>. This example could instead be written as:

<link rel="webbundle"
  href="https://example.com/dir/subresources.wbn"
  resources="https://example.com/dir/a.js
             https://example.com/dir/b.js
             https://example.com/dir/c.png
             https://example.com/dir/page.html"
/>

<script type=”module” src=”https://example.com/dir/a.js”></script>
<img src=https://example.com/dir/c.png>
<iframe src="https://example.com/dir/page.html" opaque>

Start with the linked subresource-loading.md sections on the link-based API and the main document, then review the four comments for existing discussion. The issue proposes separating opaque-origin iframe behavior from bundle URLs; done would require an agreed API direction and corresponding explainer changes.