Look at how window.sidebar and window.XMLHttpRequest and friends work. You don't need to require things to be signed. However creating such a thing does mean it's your responsibility to not enable web pages to harm the users.
_______________________________________________ dev-security mailing list dev-security@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security
