Or maybe some form of web archive format signed with a certificate? "Do you want to install Slack? It will have access to X, Y, Z"...
We already download programs off the internet and let them run with local privileges all the time, it should be possible to safely and securely extend the capability to programs delivered as html+css+js.
Also I don't see why Electron+node isn't installed system-wide like Java or .NET. Yes, I know it's because node is a server technology whose devs aren't interested in being Java, while the people shipping electron apps are just interested in the lowest friction to deploying native apps to customers, but it still seems like the kind of thing someone would have done already if only just to show off.