[nottorp]

> Compositor can also check what triggered the request (mouse click? global keybind?) to decide if the request is legitimate.

That's what I'm dubious about. But I haven't look at the details ofc.