need to look into this when i have time but
Connect-kit-loader trusts whatever the CDN throws at your dApps.
sounds like this doesn't affect us? since we're not a dApp?