For intranet/companies you should use Group Policies to install extensions: https://github.com/mozilla/policy-templates#extensions

What prevents a shitty vendor from setting up policies? It looks like all you need to do is create a file and put it in the right place.

Oh! Sounds like this can help with keeping the setup in Ansible.

I'm not sure about this new change, but Firefox "unbranded" builds don't require extension signing.