Imagine in the future we create different criteria for entering a suborigin, beyond just declaring a name-as-a-string in a header.

For example, a "strong named" suborigin, in which the suborigin is defined as the sha256 hash of the resource. Or a signed suborigin, in which the name is a key fingerprint and content must also provide a valid signature with that key to enter the suborigin. (These types of suborigin might additionally enforce certain CSP script-src and require-sri-for policies on that content so as to provide a building block for verifiable/transparent applications.)

Those can be accomplished relatively easily by declaring a new header or options, but there still may be a need to have a serialization of such a suborigin to identify it to other components, e.g. to be able to postMessage with a strong-named or signed suborigin, or to store an origin bound key in WebCrypto that only such a suborigin can access.

It would be lovely if we defined some kind of reserved prefix or delimiter (like xn-- in DNS land) so such future possibilities remained open.