Add an observation by sipa that scriptPubKey form must be checked when executing/verifying, to avoid an OP_TRUE attack.