Hashes of content are an acceptable compromise. So you still have a URL, but the client can at least assert that the content matches the expected hash.