Which in practice would only be executed by the same crowd of people who would have opted-in to the security features on the first pass.

Which in turn should be built into the browser and done automatically