I'm sorry - but having a control file (signed/encrypted/whatever), in the user's profile folder, showing what stuff was installed through the app's plugin system, and comparing to what's installed isn't rocket science...

...DNS routes you! Oh, wait...

ESB was the best of all the SW movies, IMO

But, why don't browsers automatically detect when an addon has been installed from a non-approved way (i.e. through the browser's own plugin install system), disable it at app start, and prompt the user on what to do with it? Would seem a much easier, and better use, of resources, than complaining about people who take advantage of your broken system.