For the workstation product, we would like to have a configuration that essentially comes down to trusted or public, plus possibly work.
One way would be to simply ship zones in subpackages like firewalld-zones-base & firewalld-zones-others. 'yum install firewalld' would install the -base subpackage and for complete set of zones 'yum install firewalld-zones-others' would be needed. split-zones branch: https://git.fedorahosted.org/cgit/firewalld.git/commit/?h=split-zones&id=27079a36e8ce4cb43bcc146fc3372ef5c5e05d0b
That's not required anymore.