Opening up access to "corporate" keys to all extensions (without any control from the admin's side) sounds insecure - a malicious extension would gain unrestricted ability to sign data using the key, which would effectively mean the key becomes shared with third parties (they can use it for impersonating the client in TLS, etc.).

As for the per-extension choice - isn't this existing already today? The "Allow access to client certificates and keys" checkbox in the Admin Console can be set even without the "Force installation" checkbox, and it should grant the given extension access to the "corporate" keys.

Agreed about the security risk. The option to allow this is there, but it appears to not function (at least with the extension I am attempting this with - I am unsure whether this is a result of the extension or the feature not working). I will write a small extension to verify one way or the other.