Should we also forbid `:`, since we're using that to separate the namespace from the serialized string?