Why would you exclude the obvious implementation from consideration? You missed one point though: you have to be superuser to change the flag.

This is literally already the law in California and Illinois.