Can't you just make it opt-in?

No? Because no one would opt-in, you say?

Wow. It's almost like this is a user-hostile feature that breaks the implicit promise behind a "private" repo.