Allowing websites to interact with the Debugger API is something we would like to do, but, as you note, the security implications require much more thought to get it right.