I'd go even further than that and just mandate MUST ASCII. This is a simple
means of pointing to a PKCS #11 object, not a universal means of communicating
abstract concepts in any language known to man. We've already gone from
"specify a path to load a PKCS #11 module" to something that's fast heading
towards being Turing-complete, if it isn't already
can you say "attack surface?"
http://www.cs.dartmouth.edu/~sergey/langsec/
randy