After discussing it with my team (@gnarf37 and @jugglinmike), we'd rather go with declaring these as "safe":

```js
this.tmpl.contact.interpolate(data, {
  safe: ['nameHTML', 'numberHTML']
});
```