PS: Have you never been bitten by an /etc/foo.d/99.conf that made other configurations null and void? The *.pacnew approach fails when a package introduces a new configuration through a drop-in file. The advantage of a drop-in file is that it can automatically add something new, but the disadvantage is that it can compete with and override an important configuration. IMO permissions are configurations as well. Changing a configuration automatically very seldom is a good thing.
