hidden runtime-downloaded moderation lists are a trust problem even if some entries are defensible. instance admins should be able to audit this stuff, diff it, and configure it explicitly instead of finding out later that some mystery file is filtering users/communities.