Let the gateway serve proofs of correct behavior.

#### Type:

feature

#### Description:

*Motivation.* Third-party IPFS gateways offer a lot of value to the ecosystem:
- They let clients that are constrained by bandwidth or power usage access data from the network in a more efficient way.
- A gateway can be used to answer requests if a client-side node hasn't had sufficient time to start-up yet or isn't working for unknown reasons (firewall?).
- A gateway can act as an anonymizing layer, like a VPN.

Given the above, I'd like to propose that gateways have the ability to serve proofs that they're behaving correctly. This way, gateways can't maliciously modify content before serving it to their clients. A gateway can only refuse to answer a request, in which case another gateway can be tried.

*How the feature should work.* Requests to a gateway with the header `X-Ipfs-Secure-Gateway: 1` should switch to a binary format containing the proof.

The first part of the response, called a preamble, relates the request path `domain.com/a/b/c` to the hash of the response body. It may contain a DNSSEC proof mapping `domain.com` to `dnslink=/ipfs/Qm...` or an IPNS record, as well as the contents of any intermediate directories `/a/b/c`.

The second part of the response, called the body, is a depth-first traversal of the file's DAG. The client can hash the first block and see that it equals the output of the preamble, and then check that the second block corresponds to the first link of the first block, and so on.

*Background.*
- Cloudflare announcing their gateway supported this feature: https://blog.cloudflare.com/e2e-integrity/
- A browser extension that validates these proofs: https://addons.mozilla.org/en-US/firefox/addon/cloudflare-ipfs-validator/
- PR upstreaming feature: https://github.com/ipfs/go-ipfs/pull/6126