@mathieu @alcinnz @bob

Not exactly the same, but it's true that we need to break turing completeness of CSS3 too.
But the attack surface is at least one order of magnitude smaller than HTML5+JS.

Still I agree, we'd need to dramatically polish the API surface...