Concept ACK. I think there might be a simpler approach.

1. Add another argument to Wallet::sign which indicates whether it should check for missing non_witness_utxo. Turning on this check should be decided dynamically by the caller because it depends on the context of the signing; it shouldn't be on the Signer I don't think. Consider adding a struct SignOptions passed to Wallet::sign with assume_height and trust_witness_utxo which is default false. Just do the check in Wallet::sign.
2. The "SegWit bug" only applies to v0 outputs -- it's fixed in v1 I think. So really you probably want three possible values here: (i) don't force, (ii) force v0 (iii) force all. I guess you need force all since some wallets may be stubborn about this or not upgraded.

Consider adding a struct SignOptions passed to Wallet::sign with assume_height and trust_witness_utxo which is default false

This was more or less how I implemented it initially, but there was the issue that signers like hardware wallets would basically ignore the options. I mean, I hope there's no way to ask an HW to sign a transaction while asking it to trust some parts without complaining 😅 So I came to the conclusion that this is more of a Signer-specific thing, we can control it for our signers but not for all of them. Maybe a good compromise is to have a set_options() method on Signer that returns a Result, so you could try to set the options and it would work fine on our signers but fail on HWs.

The "SegWit bug" only applies to v0 outputs -- it's fixed in v1 I think.

That's a good point

Consider adding a struct SignOptions passed to Wallet::sign with assume_height and trust_witness_utxo which is default false

This was more or less how I implemented it initially, but there was the issue that signers like hardware wallets would basically ignore the options. I mean, I hope there's no way to ask an HW to sign a transaction while asking it to trust some parts without complaining 😅 So I came to the conclusion that this is more of a Signer-specific thing, we can control it for our signers but not for all of them.

I think you misunderstood my suggestion: put the check in Wallet::sign before any signer is called to sign anything. To be clear:

    pub fn sign(&self, mut psbt: PSBT, sign_options: SignOptions) -> Result<(PSBT, bool), Error> {
        // this helps us doing our job later
        self.add_input_hd_keypaths(&mut psbt)?;
        
        if !sign_options.trust_witness_utxo {
             for input in psbt.input {
                 if input.non_witness_utxo.is_none() {
                     return Err(Error::MissingNonWitnessUtxo)
                  }
             }
        }

        for signer in self
            .signers
            .signers()
            .iter()
            .chain(self.change_signers.signers().iter())
        {
            if signer.sign_whole_tx() {
                signer.sign(&mut psbt, None, &self.secp)?;
            } else {
                for index in 0..psbt.inputs.len() {
                    signer.sign(&mut psbt, Some(index), &self.secp)?;
                }
            }
        }

This means it doesn't matter whether they are hardware wallets at all.