Distributing service worker script via SXG

We have a use case with an untrusted front-end server that hosts a service worker source script as a signed exchange:service_worker.sxg.

The main page of the website is also distributed as a signed exchange and registers the service worker as follows:

// This JS is running with the `trusted.back.end` origin.
navigator.serviceWorker.register('https://untrusted.front.end/service_worker.sxg');

Currently this fails in Chrome 107 with an error:

Failed to register a ServiceWorker: The origin of the provided scriptURL ('https://untrusted.front.end') does not match the current origin

Question: What is the expected behaviour according to the SXG specification here?

Based on the explainer and the spirit of SXG, I was expecting the service worker registration to succeed because the service worker source script resource should be considered as having the same trusted origin.

Start with the service worker registration call shown in the issue and read the SXG explainer and specification sections governing origin handling. Compare the expected behavior with Chrome 107's reported error; done means documenting the specification's answer and whether the observed behavior conforms to it.