• The setHTML() method inserts HTML into the DOM in a way that prevents cross-site scripting attacks.
• The parseHTML() method of the Document object provides an XSS-safe method to parse and sanitize a string of HTML in order to create a new Document.

I will limit the scope to setHTML() and Document.parseHTML().

There are separate Interop proposals for the new HTML setter methods and for the streaming methods, so please also vote for those.