allow Device Admin app to provide whitelist of "trusted" repos
Something that's needed is something like a toggle for "trusted" repos that Device Admin can control. One thing device admin is supposed to be able to do is forbid unknown apps, but at the moment, it can be bypassed by adding repos.
It's a bit complicated since Device Admin would want to be able to whitelist f-droid repos, it'd have to have f-droid specific code, the only question there is how F-Droid should verify the info from Device Admin. Once we know how to securely allow Device Admin to send data to F-Droid, then its easy.
isDeviceOwnerApp(String packageName) is probably fine, don't think there's a need to worry about races.
There's also a concept of "profile owners" which might be related.
@thestinger based on our convo today