Solved: bluez 5.43 have bluetooth disabled on boot

Hello,

I am setting up a home linux desktop for development projects, and have decided to use Fedora 25. The PC has built-in bluetooth, which is working in Fedora 25 + xfce4, through the bluez 5.43 package.

I'd like to be security conscious, and don't feel comfortable with bluetooth turned on normally. Ideally it would be nice to have bluetooth disabled on boot, but to be able to turn it on easily with the blueman-applet program in xfce4.

Running

rfkill block bluetooth

seems to be a good way to do this as it disables bluetooth in the applet (as well as the hciconfig controlelr) and it can easily be turned back on via the applet. But I can't figure out any way to keep bluetooth from being enabled on system startup.

I've noticed that if I disable bluetooth via rfkill, and then restart the bluetoothd process, bluetooth becomes unblocked in

rfkill list

Is there any way to keep the bluetoothd process from enabling bluetooth at startup? I've tried changing the AutoEnable option in /etc/bluetooth/main.conf, but doesn't seem to make a difference. I think I'd be happy even modifing the bluez sourcecode and rebuilding, but can't make out what may be happening in that source code. I don't know much about security, but I'd like it if the solution didn't involve having bluetooth turn on and then back off during startup.