Gerrit change 181958[1] was recently merged, which allows (among other things) the ability for sysops to irrecoverably delete change tags. Since irrecoverable deletion of anything from on-wiki is rather unprecedented, I think we should stop granting it to all sysops in DefaultSettings.php, so that wikis have to "opt-in" for this feature to be enabled. Thoughts?