I like the fact that a security issue is being tackled. What I absolutely hate is the fact that there are no ways to turn this option off. Just like HSTS I can't turn this off and it leaves a bad taste in my mouth. Were originally I considered firebox to be a browser for power users, now I'm not too sure any more.
HSTS allows a site owner to set a security policy for access their own servers. There's no downside to using it, it doesn't affect anyone else, and in any case if you choose to use a service you're subject to their security policies. The fundamental choice is unaffected: use their service or go somewhere else.
In contrast, this is more controversial because it involves telling the user that they cannot do something they want to do. I think there's a strong argument that this is a pragmatic choice in the current security environment but it really does undercut user choice unless you reach the point of saying that the users who want to do this should know how to compile Mozilla.