Pretty insightful. Regarding the last part of your comment, I don't agree with the idea of using a developer certificate. In the case of malicious software, this only pushes the malicious developer into having to have their piece of software create maximum damage at once, since they will only get one shot at it. I like the current Android approach better: when you install an app, the phone lists all the pieces of functionality that the app will make use of. I assume this is done through a cursory source-code analysis but i'm not sure. This means that you can tell ahead of time if that app will be using your GPS sensor, or be sending SMS messages.