Android Developer Blog just released (and a fun email to go along with it) that permissions are to be slim. If you’re not using them then they need to not be requested.
Could we please revisit this thread:
And figure out a way to specify what would be needed vs required for OTA updates? I would love to do this without ejecting every time.