Ok, I understand your first point, but the second example (content alteration) is desired in this case, disabling the XSS vector. This alteration doesn't differ much from removing `<script>alert(1)</script>` when `keepScripts` is not passed. As I've explained in the commit message, I don't see a safe and future-proof way to remove the event handler entirely.

So maybe a different valid prefix would be a middle ground we could agree on?