Who is in charge of this and what is necessary to get changes made?

Let me point it out that at no point in my initial post am i advocating a system less secure than what is in place lest the impression be given that it was a request that needs to be debated. Again, it's simply a request that the process be completely implemented as planned.

Since we're kinda off in la-la hypothetical land with the discussion, let me throw at you a scenario: it is discovered that a popular app in Extras has a timebomb built into it that will do something really heinous in one more day. What do we do?

First of all, we do need a demote button and it does need to be accessible to official testers. They need to be able to demote something from Extras found to be in violation of QA criteria, and able to throw testing versions back to -devel when blockers are discovered (to avoid wasting tester's time).

Second of all, the system needs a built-in facility to inject a stub package into Extras that displays a customized message when installed or executed. Bonus points if app manager recognizes it as an "urgent update" and gives unusual notice of its existence.