Yes, that's called "opt in" and it's the same security model this standard is proposing.