On the widget side, technically, we need to finish the widget URI scheme spec. It currently lacks a proper dereferencing model, which means it does not work well as a protocol. What it needs is to work like blob:// so that it can be used with XMLHTTPRequests (i.e., fake HTTP responses). This will allow things like JQuery mobile to work better… or we need to look to switching to blob://. Also, Widget Updates needs to be finished.
We also need to continue investigating how to get widgets to work better with OAuth. This is a general problem with native applications, and the OAuth 2 spec does not provide too much guidance:(
Politically/Business-wise, we need to get Moz, Google, or somehow get this supported in Webkit… otherwise, this is not going anywhere.