So I've added the secondary check in the block.check(context) call, which will result in rejection of the block immediately after download, in the case where segwit is negotiated and required witness serialization is missing. And immediate dropping of the peer. Basically it just internally extends block.is_invalid_witness_commitment() with no interface changes.
(edited)