I suppose that could be the answer: allow the configuration to specify a custom local path/tarball from which to install the user's custom theme. Would that be an acceptable compromise?