At the moment we serve HTML5 games through v6p9d9t4.ssl.hwcdn.net, but in the future we may migrate them to our own domain. For future proofing, you can add *.itch.zone to the sitelock. (That is, any subdomain on the domain itch.zone).
Something we're also considering is injecting a small piece of javascript to every HTML5 game that implements a sitelock automatically. If you like or dislike this idea tell me.