Just pushed latest #taproot changes: using htmlpurifier.org to remove any nasties in reply contexts and comments, hopefully with upcoming php-mf2 changes that’ll allow limited HTML comments!
Also using brand new php-mf2-cleaner to parse said reply contexts and comments, find authors, etc. Check it out if you deal with #microformats 2 at all in PHP.