Don't allow that. When a site registers as "local", which gives it the "local" badge, do not allow the site to switch back to non-local. Perhaps the site could

Don't allow that. When a site registers as "local", which gives it the "local" badge, do not allow the site to switch back to non-local. Perhaps the site could be allowed to update itself. But this update function should not have access to any local/client state.