I wonder if a good middle ground (restricting this without breaking legacy sites) would be to add a permission for this. By default any target=_blank or similar

I wonder if a good middle ground (restricting this without breaking legacy sites) would be to add a permission for this. By default any target=_blank or similar opens in the same tab, but it shows a permission or the 'pop-up blocked' notification, which allows the user to open it in a new tab, and grant permission for the site to do that by default. As a user you can still ctrl/cmd-click to force links (which are proper href links) to open in a new tab.