I put all the xss stuff from the big list of naughty strings into a tls certificate, lets see if anyone notices.