My thought was that `set_rendered` was ambiguous and would be easy to call with the assumption that it was safe.  A couple alternatives would be to leave everything as-is, and put the TODO comments in the `set_rendered` or leave the TODO comments there and rename `set_rendered` to something like `set_html`.  Do you think either of those are better?