Govspeak does *not* sanitise by default