Sign .desktop files

Part of the problem is how to allow local .desktop files to be installed, something that some places/people will want to do. How about having a signature block in these files that can be checked before the .desktop is run. ''Standard'' installed stuff can be checked against standard public keys, a site could install its own public key somewhere.

Maybe not the entire answer, but good security is multi layered: belts and braces.