[bawolff]

Put it in an iframe with a Content-Security-Policy header?

[Avamander]

Some providers do that.

But you still have to dynamically allow or disallow external content such as images. It also makes any operations based on the content more convoluted. Like adding event invites to calendar and so on.