This one is clearly one of those "doomed to repeat history" things in
motion.
Protected packages was first implemented * as a yum plugin because Seth
thought it was kind of crazy and shouldn't be core functionality, but then
it proved itself in real use and became built-in. Now, the DNF pages says
"Similar functionality can be implemented by a plugin", putting us right
back where we were. **