Assertions are untrusted client-supplied data, they need to be
subject to the same precautions that we use elsewhere.