> I only need to trust the addon that I install the user script with

I wonder why this is even necessary. User scripting should be a standard feature of browsers. We should have direct access to a complete Javascript environment every time we launch a browser. Just like Emacs gives users a Lisp environment.