I don't understand the last point: if I can only purchase and install them from Chrome, how do I run them in another browser? Just point the non-Chrome browser at the (un-DRMed?) local install after purchasing/installing with Chrome?
Apps are essentially a metadata wrapper around a URL^. The payment authorization is done server-to-server. Thus you could buy an app in Firefox and authorization would still work fine, the UX just won't be as nice.
^ We are also considering supporting fully packaged apps that are completely offline, like Chrome extensions are today -- these won't work in other browsers because they don't understand our package format.
Using bundled packages for offline support is entirely the wrong strategy. The coupling is too tight even before you start trying to use the same format for multiple browsers.
You should just copy Apple and just make it easy to save web pages as local apps, though you might want to explicitly offer with an infobar when there's a manifest available. What they already look for is all you need:
<html manifest="..."> and window.applicationCache
<meta name="application-name"> and <meta name="application-url">
<link rel="icon" sizes="..."> or <link rel="apple-touch-icon">
The capability model for requesting extra permissions is terrific, but it should have been done using <meta> or <link> tags -- reusing their bundle format for extensions was a terrible idea, especially since they're going to have to implement all the DOM-based stuff anyway.
