Ping- this is relatively simple, so I may just commit it later this week, unless someone has time to give it a once-over.

Implementation-wise it seems reasonable, but every time bsdinstall hardening gains an option the security world cries out in pain over having sensible defaults and good UX :')

In D57755#1328574, @jrtc27 wrote:

Implementation-wise it seems reasonable, but every time bsdinstall hardening gains an option the security world cries out in pain over having sensible defaults and good UX :')

Ah shit, sorry, I should have added you as well. My hope is that I can MFC the original change and this one, then try to convince -arch@ that this should just be the default behavior for 16.0 and the knob can go away again.