Conor Schaefer

In our case, LibreOffice is running in a DispVM, so the once-per-VM-start effectively becomes "every single time." Configuring via features for 4.1 sounds like the right fit for us, thanks...

A balanced approach would still get us quite a reduction in complexity: * use the `securedrop-workstation` TemplateVM for `sd-proxy`, consolidating as described in #471; _and_ * set its `netvm` to...

> We should also make sure to rebase the protocol/breaking_2025q3 branch on top of latest main. Done. As a precaution, I created `protocol/breaking_2025q3-backup-2025-08-28` before force-pushing, so all history is recoverable.