I have been thinking for years of a different trust mechanism for packages, one that is closer to capabilities, i.e. what Android is doing these days for applications.

Both approaches could certainly coexist!