Sandboxed file access

Well, sure, but my thesis here is basically that if the open-a-file API is unusable, nobody will use this approach. It's very easy to design secure and unusable systems. So the effort for it would be wasted, and one of the existing submission interfaces, e.g. manually-reviewed Extras or Debian packaging, would be the only things people actually use.