That’s what works best for sure 
. If there was a way to have some safe-store then great, but that area is a concern (start charging, censor etc.). However do not let that put you off, just focus on that part as it also has parallels in the upgrade code location as well (where should you upgrade from and what stops malicious behaviour etc.). So this is an ongoing issue and more heads will help there.
So issue becomes
- A mechanism to mathematically prove something that meets simple rules and these rules cannot prevent in any way uploads/use as long as they follow these rules. (heard it before somewhere
)
I hope that makes sense, you are in the area where everything is dependent on every other thing, not in a chaos effect way (yet) but in fundamental types and those types uses way. So deep thinking will get the answer and as usual it will be simple.