I've tried wget from a couple of different normal Linux desktops (not SDK), and I get a 403 forbidden. I don't know why wget from the N900 works. Strange, isn't it?
I don't really know enough about deb packaging, but would it theoretically be possible to create a .deb that overwrote or deleted /etc/X11/Xsession.d/34cherry, /usr/bin/cherry, libcpcherry.so (the hildon-control-panel plugin) etc?
I guess maemo.org Extras won't host it, but it could be hosted elsewhere. My aim is to find the most user-friendly way for people to avoid this.