Google wants the same thing for the web. Google's plan is that, during a webpage transaction, the web server could require you to pass an "environment attestation" test before you get any data.

As Kestrel is highly customizable, you can manage the HTTP verbs that are supported when accepting requests from browsers, as well as manage the way your server responds to specific URI structures.