But hold on, that isn't only about securing XEmacs packages. A few $.2
reactions:
1) 6MB is not much. Who will complain about 6 more MB's? If people can't
afford to download 6MB, they don't have to, thanks to the packaging
system. IMHO, I wouldn't even worry about a 60MB package, should one
exist. Optimizing for size is a waste of time 99% of the time.
2) Why _are_ the JAR files included in XSLT XEmacs package in the first
place? Are they used as data files and parsed by Elisp code? In that
case, I'd say include them. No need to download them on the fly. If they
instead constitute an external Java application, it does not make sense to
include them nor download them. Lots of XEmacs packages requires external
applications -- splitting the XSLT package into the elisp part and the
Java part seems easier. The elisp part should document that it requires
the external Java part installed.
These problems seems orthogonal to securing XEmacs packages.