Currently 'qcheck' checks CONFIG_PROTECT-protected files like any other, creating fake positives for files which basically are supposed to be changed by user. I think it would be useful to support a command-line option to omit mtime/checksum checks for these files.
http://sources.gentoo.org/gentoo-projects/portage-utils/qcheck.c?r1=1.55&r2=1.56