I guess we will find out, that sounds like a pretty big roadblock for the skill level of users I am working with.

There seem like there's a better solution out there, at leat for my use case. I serve the crx bundle from the same domain that it interacts with, that seems like it could be pretty malware proof.