If you want to make sure, every Krita contributor read this document, you might just want to use a Legalpad document instead, then set the "Editable By" policy of Krita to a custom policy which has the corresponding Signers of Legalpad document configuration set.

In D3055#56708, @subdiff wrote:

But I wouldn't add it to this diff, since it can be done independently of this diff. Rather someone (you? me?) should create a new diff in the future regarding this feature.

What about hiding the password input field (or at least providing the required property) as long as the password grace period hasn't expired?