This was discussed with @ematpl.  We thought it was best to ensure that only expected values get into the ccdb.  Given the strings are expected to come from "trusted" code, it seemed like a reasonable behavior.

If a bad value does come along, it's coming along on an already unhappy path.  The app remains with a 'PENDING' app package.

I'm happy to consider alternatives.  Thoughts?