That is exactly what we did.

Bonus fact: we didn’t actually read the bundled code - we downloaded it from the internet and ran it as usual. But a server-side check ensured you could only get the JavaScript we’d bundled.

Or at least it did until we eventually quietly turned off the check, when Apple stopped paying attention.

Oooh, clever :). Just dash quickly when the Sauron's eye looks in another direction :)).