Websites can currently ask to install protocol handlers (notable, mailto:) or search engines (for "Tab to search" [1][2]) when users visit.

For protocol handlers, the user must click on a page action indicator to approve the handler. Search engines are added automatically if the user visits a site that asks, or performs a certain search on a site [1].

Once installed, a handler allows sites to intercept links and queries that are reasonably likely to be valuable/sensitive to the user.

I would like us to consider protocol handlers and custom search engines these to be powerful features [3][4] and disable the normal installation process from non-secure origins.
(However, it seems okay to me to allow users to explicitly add insecure origins as handlers in settings if they want.)

jww@, how do we go about defining what is a powerful feature? Should we start by measuring usage on secure vs. insecure origins?
Is there an a priori process that possibly disqualifies these from being considered secure features?

[1] https://www.chromium.org/tab-to-search 
[2] Also see 616996 (currently restricted).
[3] https://www.chromium.org/Home/chromium-security/deprecating-powerful-features-on-insecure-origins
[4] https://www.w3.org/TR/secure-contexts/