Oh, absolutely. That's pretty much the model I was trying to suggest as well, with the extra detail that users only get that prompt for "optional" permissions.

Oh, absolutely. That's pretty much the model I was trying to suggest as well, with the extra detail that users only get that prompt for "optional" permissions. "required" permissions (e.g. a browser accessing the Internet) would still be take-it-or-leave-it at installation. Though, thinking back to a Google+ post by a member of the Android team that I don't have at hand right now, there's also a place for self-certifying UI elements. IIRC, their example was a system-provided Contacts widget (where if you selected a contact using that widget from within an app, you were clearly giving the app access to that contact data). My favorite example is the crash reporter. If click the "Send Crash Report" button, you're clearly giving permission to share some, potentially private, data about the crash (and sharing even more if you also check off sending the crash log). When you can pull off those sorts of UI elements, it is ideal, but they're not general enough for everything.