Also, what would be the best way to ensure that, by default, no roles (except the function owner) have any privileges on new functions created in my protected schema?
Create them in another schema altogether, then move it to my_schema once the privs have been set.