I think we can verify the checksum of the running code for plugin matches the source code. Similar to signing of .jar files
Can you describe with details few things:
- what the plugins could do and why they should be used
- HOW they should be made? (that is should they operate on API or they should be REAL plugins)
- what about people who don't want plugins? how limiting it (lack of plugins) will be?
- How do you actually imagine this smtp plugin would work like (I'd like really detailed description along with use case description https://en.wikipedia.org/wiki/Use_case)
- How do you imagine TRUSTing the plugins?
To be clear, I'm asking those questions, as most likely I will criticize the idea, once you answer to those questions.