Currently we can't execute the signature verification in a Web worker because the Web interface does not exist.

    const verifier = Cc["@mozilla.org/security/contentsignatureverifier;1"]
      .createInstance(Ci.nsIContentSignatureVerifier);

    let valid;
    try {
      valid = verifier.verifyContentSignature(
        serialized,
        builtSignature,
        certChain,
        "normandy.content-signature.mozilla.org"
      );
    }

Could become:

// worker.js

importScripts("resource://gre/modules/content-signature-verifier.js");

ContentSignatureVerifier.verifyContentSignature(
    serialized,
    builtSignature,
    certChain,
    "normandy.content-signature.mozilla.org"
);

I believe that the signature verifier relies on code that can't currently run off-main thread, so this isn't as simple as adding a definition for the interface. I think this work might already be tracked elsewhere. Dana, can you comment on this?

Currently this would depend on figuring out the threading issues with the implementation in bug 1534600.

Landing bug 1541942 removed threading restrictions, so this should be easier now (although bug 1534600 would still be helpful in that it would be nice to have an asynchronous API here).