How does one protect the majority of users in the wide open case? For example see https://bugzilla.mozilla.org/show_bug.cgi?id=1251911 where the extension downloaded another extension and disabled the signing pref.