I see what you're saying. But there's no reason why you couldn't do the same thing with this design. You can build a basic DOM model that is allowed and only le

I see what you're saying. But there's no reason why you couldn't do the same thing with this design. You can build a basic DOM model that is allowed and only let that portion through. While the outer layer uses Javascript freely to run. You can decide what policy you want before displaying any output.