> But apps can tell when their permissions are denied, so some of them straight out refuse to start unless you give it all the permissions it wants.

I'm pretty much fine with this, though the data-hostage situation you describe does seem bad.

You're right that from a user control perspective, the cyanogenmod approach is likely best.