We have to do EV certificate verification for every resource...

chrome/browser/renderer_host/resource_dispatcher_host.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
 
 #include "chrome/browser/renderer_host/resource_dispatcher_host.h"
 
 #include <vector>
 
@@ skipping 422 matching lines @@
   URLRequest* request = new URLRequest(request_data.url, this);
   request->set_method(request_data.method);
   request->set_first_party_for_cookies(request_data.first_party_for_cookies);
   request->set_referrer(CommandLine::ForCurrentProcess()->HasSwitch(
       switches::kNoReferrers) ? std::string() : request_data.referrer.spec());
   net::HttpRequestHeaders headers;
   headers.AddHeadersFromString(request_data.headers);
   request->SetExtraRequestHeaders(headers);
 
   int load_flags = request_data.load_flags;
-  // EV certificate verification could be expensive.  We don't want to spend
-  // time performing EV certificate verification on all resources because
-  // EV status is irrelevant to sub-frames and sub-resources.
+  // Although EV status is irrelevant to sub-frames and sub-resources, we have
+  // to perform EV certificate verification on all resources because an HTTP
+  // keep-alive connection created to load a sub-frame or a sub-resource could
+  // be reused to load a main frame.
+  load_flags |= net::LOAD_VERIFY_EV_CERT;
   if (request_data.resource_type == ResourceType::MAIN_FRAME) {
-    load_flags |= net::LOAD_VERIFY_EV_CERT | net::LOAD_MAIN_FRAME;
+    load_flags |= net::LOAD_MAIN_FRAME;
   } else if (request_data.resource_type == ResourceType::SUB_FRAME) {
     load_flags |= net::LOAD_SUB_FRAME;
   }
   // Raw headers are sensitive, as they inclide Cookie/Set-Cookie, so only
   // allow requesting them if requestor has ReadRawCookies permission.
   if ((load_flags & net::LOAD_REPORT_RAW_HEADERS)
       && !ChildProcessSecurityPolicy::GetInstance()->
               CanReadRawCookies(child_id)) {
     VLOG(1) << "Denied unathorized request for raw headers";
     load_flags &= ~net::LOAD_REPORT_RAW_HEADERS;
@@ skipping 1470 matching lines @@
   return is_prefetch_enabled_;
 }
 
 // static
 void ResourceDispatcherHost::set_is_prefetch_enabled(bool value) {
   is_prefetch_enabled_ = value;
 }
 
 // static
 bool ResourceDispatcherHost::is_prefetch_enabled_ = false;