I work with Rahul on Kapyn, so I have a connection here. The change-owner point is the one I would keep in the client config: who will recheck the package or endpoint after an update, and who can revoke the access? A review at install time is easy to lose when someone else inherits the setup.