There's a discussion about this on an internal GNU mailing list.
One path that GNU might take is downloading scripts into the users home directory so they have control over them, possibly based on the dotjs extension: https://github.com/rlr/dotjs-addon
