> But then HN would still riot, because you would need to require all apps to be approved by a central authority (no unauthorized browsers) OR you need to lock down browser engines to those that respect the list somehow (maybe by killing JIT, limiting network connections).

The owner of a device could prevent the installation of third-party apps or app stores. That does not require having central approval.