Yeah, this. 1password does the same thing for any browser it detects when installed for the native desktop integration from the chrome extension.

Not 100% across the spec but this wouldn't functionally do anything until you install the related extension? e.g., it's pinned to nominated `allowed_origins`

Yea I guess the issue here is whether you think installing the extenstion should set up the integration or installing the thing being integrated should set up it. Im inclined to think its the extensions responsibility, but I dont think its a severe data issue.