Any proposal of untrusted user level software installation will require, to be legitimate, a well implemented MAC solution to the program. Android actually demo

Any proposal of untrusted user level software installation will require, to be legitimate, a well implemented MAC solution to the program. Android actually demonstrates this fairly well using SELinux and app permissions. New software could present its access requests to the user, to be approved or not. Unapproved or undocumented accesses are also displayed as notifications, where declining the running apps access becomes a permanent rule. Of course, to standardize such a system across distros, either you need an abstraction layer access management syntax, or you have to get everyone to agree to one of SELinux / Grsec / Tomoyo / Apparmor. Really though I think the obvious answer is that ten years from now we have something like xdg-app shipping generic usage filters and mandating userspace MAC on new programs, along with an xdg -> distro specific library mapping layer from something like appstream.