thinking out loud: it'd be great if web servers could sign their responses+timestamp, so you could guarantee getting the right content even through such intermediaries

This already exists in a limited form as Signed HTTP Exchanges. It's intended primarily for caching and serving content from CDNs, but associating with the origin host.

https://www.ietf.org/archive/id/draft-yasskin-http-origin-si...