Hi Ard,
Talked to the team and I think the appropriate answer to this is to follow what is currently done through the MSVC FLAGS, i.e. that any PE that knowingly does not meet these requirements manually opts out of NXCOMPAT via the /NXCOMPAT:no flag. That means adding a flag to GENFW: "--nxcompat no". Then this can be appended to existing flags in the INF of any incompatible component.
Invalid PEs could be reviewed after this patch is in, or as a part of it. We have a list of modules that modules that are potentially non-nx compat, but would need to be evaluated by package owners and may not be all encompassing.
Thanks,
Joey