I don't think those goals are actually contradictory. Cryptographically verified auto updates, manually acknowledged non signed file upload updates can coexist

I don't think those goals are actually contradictory. Cryptographically verified auto updates, manually acknowledged non signed file upload updates can coexist peacefully.