And I also don't want to be too dependent on the browser vendor to sign a plugin.

There is a lot of talk about security but strategic security would mean to put flashing red warning signs on the manifest updates.

To neglect that is basically lying to users in my opinion.