If you require the user to hook into iTunes/Xcode, flip the device into recovery mode, click a few buttons, and agree to a "You're hecked if you break it now" policy, it'll be enough to scare off 99.9% of people from getting owned. After that, just have it work like the current profiles/supervision system where Settings makes it clear that non-verified code is running and has a big "make it go away!" button (sideloaded IPAs show up in profiles with a delete app button, and that works well enough except for the time limit).