It should be turned on by default then with an override option, so that the average home user can't install stuff that'll bork the system without being warned.

It should be turned on by default then with an override option, so that the average home user can't install stuff that'll bork the system without being warned. Just like SIP in OS X or Developer Mode on Chromebooks (although that's more extreme).