SRI hashes the exact UTF-8 text or file bytes; choose "Fetch the URL" to hash the bytes the host actually serves instead (one cross-origin GET without credentials, so the host must allow CORS — public CDNs do; 8 MiB, four seconds). The digest is of the response as served and is not verified against anything else.