At one point I had it as a required part of the protocol, but later decided that it added a lot of complexity so moved it to an extension. I'm currently workin

At one point I had it as a required part of the protocol, but later decided that it added a lot of complexity so moved it to an extension. I'm currently working on a minor reorganization of the protocol in the protocol_cleanup branch. I'll see if I can fold untrusted mode back into the core protocol.