Comment
Comment by snek
We have APIs to put content in DOM elements without it being interpreted as html, and we have APIs to build DOM elements without using strings. Given that trusted types don't actually prevent xss from occuring and only make your data flow more explicit, why not just recommend to developers that they use the other APIs, instead of adding this new one?