I've pushed a branch to psych that contains [a whitelisting safe loader](https://github.com/tenderlove/psych/tree/safeload).  I've introduced a [class loader object](https://github.com/tenderlove/psych/blob/safeload/lib/psych/class_loader.rb) that can be used for implementing the whitelist.  We *could* run all the symbols through there as well.