The capability model for requesting extra permissions is terrific, but it should have been done using <meta> or <link> tags -- reusing their bundle format for extensions was a terrible idea, especially since they're going to have to implement all the DOM-based stuff anyway.