It would probably be enough to have hashed module names in the RL startup module. Whenever something is requested via mw.loader.load it is referred to by name, so we can easily resolve this client side. For loading dependencies (which the caller to mw.loader didn't explicitly ask for), we would need to alter load.php so that it can serve things by hashed module name.
- mw.loader.getModuleNames which returns a list of all module names (not used much it seems)
- Getting a reasonable safe hash function into the clients also costs bandwith (+ some CPU time… hashes need to be computed)
This hasn't been proposed/ discussed before as far as I can tell, so I just wanted to bring it up so that we can evaluate it.