What am I worried about?:
Can we go with having a service contract to figure out the local url to display an object that every package has to implement for every object type it provides?
As long as there is no requirement to implement this for every object, great.
I would think that every package instance could elect to not have its objects included in the search? If all instances of a package elected to be private, I would hope that the existence of the object types in that package would also remain private.
If not, this is just a back door to what was supposed to be a secure system.
Why, again, does this need to be in the core?