> What would a safe extension model look like to you?

> At some point, you have to implicitly trust someone

A model so I trust my OS and my browser, and I don't have to trust anyone else, that is, they can't harm me.

You need open source extensions (they are now, as the source is included) and you need to personally audit them, or you need to find a browser with every single feature you want.

Or do you want the browser to enforce permissions on extensions so you can lock them down as well as auditing them?