Why does it need to contact an external service? I thought the extension ID changed when the owner changed, so you'd just need to locally track extension IDs and flag any new ones that appear. Or do I misunderstand something?
Extension IDs do not change, in my experience. (I could be wrong in some cases, but I know for a fact that at least one extension I've used has been bought up without the ID changing.) It seems to me that if they did change, it would defeat the purpose of buying up extensions in the first place, because automatic updates would stop working and they'd lose the installed user base.
