The one problem I have with the trusted files thing is that I have no way to trust non-file-visiting buffers. Why is *scratch* untrusted!? *scratch* should always be trusted, without me having to configure anything, ideally. Though a setting to automatically trust non-file-visiting buffers would be nice. I just ended up stopping using the scratch buffer because of that issue.
Right, the fact that the initial scratch buffer is untrusted is a bug AFAICT. I'm considering adding a workaround to this issue in trust-manager, although ideally it should (also) be solved upstream.