I wondered that myself. I think so. The key was treated as HTML safe before. Changing that would be a breaking change if anyone had put HTML content in there.