REQUEST_INSTALL_PACKAGES policy
AFAIK #371 (closed) was closed without ever resolving the discussion around "hav[ing] the scanner detect REQUEST_INSTALL_PACKAGES
and mak[ing] sure apps in F-Droid can only get published with that permission when the YAML says they're allowed to" (which there was some agreement on doing).
That still seems like a good idea to me, hence this separate issue.