If a page is whitelisted it should be indicated on the toolbar icon or the badge.
Spec:
Ideas:
@Thorin-Oakenpants: what are your thoughts?
So assuming badges are not optional
You can deactivate the badge if you want to.
I'm not sure I follow this. The badge is the notification indicator
You can also have a color change on the toolbar icon as a notification indicator
I will go with the gray icon for whitelisting:

Should the toolip text also reflect the whitelisting?
The question is: what happens if the url of a tab is whitelisted but an iframe within is not? And the other way round?
Should the icon stay gray? Or should it be red?
Not sure if this only just a little bit confusing or a lot:

Is a whitelist badge even useful, with all the external resources that are embedded in modern websites? This message would confuse the shit out of me, if I didn't think about it for 5 minutes before posting this..
Most of the external resources are not included via iFrames/frames and will therefore not create this kind of message (they are also whitelisted as I check the URL of the tab and not the URL of the executed script).
I think I will go with that in the first place and see how many confused user arrive. In the notification popup the user can have more information about which URL/domain was protected.