how would that be enforced? unless extensions now be required to be WASM blobs, or otherwise using some very simple runtime. (ie. not JS/Node) I think we learned this with the JVM (applets) and the Flash player.