simple security idea for installation pages

I think this might be a simple but effective solution to the threat posed by not deleting the /setup directory after installation (whether due to ignorance, forgetfulness, stupidity, etc.)

Couldn’t the first or second installation screen (the one that lets you choose "new" or "upgrade") be modified so that if it detects an existing installation, you are required to enter the site_id string from /core/config/config.inc.php before continuing? You’d have to have back-end/server access to know the value... which a legitimate user would have, but illegitimate users would not (unless they’ve hacked your server, in which case you already have bigger problems).

Would this work? Is it a good idea?

It should work (I think), but it would be quite a pain for people doing many upgrade installs on a localhost site, unless there was a system setting to turn it on and off.