I just tested the following under the current Chromium implementation:

<script type="importmap" integrity="sha384-invalid">
{
  "imports": {
    "module": "./module.js"
  }
}
</script>
<script type="module">
import m from 'module';
console.log(m);
</script>

and unfortunately it appears that the integrity check on the import map script itself is not applying.

I was under the impression that the CSP compatibility discussed in #105 would have enabled this.

Is this a spec or implementation bug? Would be good to follow up further as this seems pretty important.