> 2) Every extension has to provide schema of any data it intends to send out of browser.

Just because I supplied a schema does not mean I'm not exfiltrating sensitive data, in a way that would not be obvious from the logs.