After thinking about it more, I admit that you've admonished me--yet
again. ;-)  CONF_FILES and its bretheren are probably all of the
centralization we'd need.

I still think Matthieu Herrb sets a worthy example in how OpenBSD's
xenocara (X.org tree) lays out its configuration files.  I'd also like
to see his privsep code incorporated into our X.org packages at some
point; I'd be glad to help with that in the future after we tackle
more pressing issues.
IIRC (I spoke with him about this many months ago), a vast majority of
that code is OS-independent--or certainly independent enough for
NetBSD.  We indeed have a friend in patch's -D argument.

--Blair