Checksums are super useful, too - if you build the project yourself, you can get the checksum, and if it's different than the one in the store, you can ask questions.

A web of trust style checksum confirmation network would be invaluable for browser extensions. Building that into a browser's security model would be great - an extension has to be validated with a minimum score or it's disabled unless manually activated.