> The only answer I can think of is through app stores run by trusted browser vendors.

Exactly, that's clearly what Google are thinking too, as you can install apps from the Chrome web store with elevated privileges today, e.g. the Secure Shell app: https://chrome.google.com/webstore/detail/pnhechapfaindjhomp...