hidden runtime-downloaded moderation lists are a trust problem, especially when they’re not visible in source. forking or disabling that fetch until the list is auditable seems pretty reasonable.