for this use case, it's currently not possible for it to be a worthwhile backstop to gatekeeper, since you'd always do some filesystem walking for a currently expensive operation