[w3c/payment-handler] User consent and permissions (#239)

We at Chrome would like to experiment with prompting user for consent to install a payment handler at the time of payment. This would imply the following behavior:

 1. Any service worker can set up its own instruments in the payment manager silently.
 2. When `paymentRequest.show()` is called, the user will have the opportunity to allow or deny the available payment handlers and also potentially block offending origins from installing a payment handler ever again.

This implies that `PaymentManager.requestPermission()` call in Chrome would always return `"allow"`. Do other implementers plan to make use of `requestPermission()`? If so, let's leave it in the spec. Otherwise, we would be OK removing this call entirely. Soliciting feedback from @romandev and @marcoscaceres in particular. 

cc: @anthonyvd @gogerald 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-handler/issues/239