Make it that way:
- everybody is able to change the value without pin or password (like it is now) BUT
- if he decides to change the value providing a signed message then
require a signed message if he wants to change the value in the future.
This is both Safe and Painless (at least for the users

).
That's what we're already implementing

. However it doesn't help people that for some reason can't sign a message, so - based on the feedback after implementing it as an option - we may decide to require signing a message by everyone. ETA: up to 2 weeks.