Do you develop on GitHub? You can keep using GitHub but automatically sync your GitHub releases to SourceForge quickly and easily with this tool so your projects have a backup location, and get your project in front of SourceForge's nearly 20 million monthly users. It takes less than a minute. Get new users downloading your project releases today!
I'm sorry - but having a control file (signed/encrypted/whatever), in the user's profile folder, showing what stuff was installed through the app's plugin system, and comparing to what's installed isn't rocket science...
But, why don't browsers automatically detect when an addon has been installed from a non-approved way (i.e. through the browser's own plugin install system), disable it at app start, and prompt the user on what to do with it?
Would seem a much easier, and better use, of resources, than complaining about people who take advantage of your broken system.