I found a simpler way to express the desired behavior: If DH_INTERNAL_OPTIONS specifies a set of packages, all packages not in that set should be excluded.
I've checked in an implementation of that, which turned out to be simpler too. -- see shy jo
signature.asc
Description: Digital signature