I haven't read the specs or anything, but a packing format where anyone can upload their application, and we cannot verify the installation script isn't a good

I haven't read the specs or anything, but a packing format where anyone can upload their application, and we cannot verify the installation script isn't a good idea IMO.