Mostly passing along some of the comments from this Blink Intent-to-implement.

The use of a safelist presents a challenge to someone introducing a new protocol who wishes to integrates it into the web platform via registerProtocolHandler. They'd need to file a request and, assuming browser vendors react immediately, face around a 3 month lead time until stable browsers start supporting the new scheme. A blocklist removes this delay and also makes new schemes backwards compatible with existing browsers that use a blocklist.

On the other hand, the use of a safelist allows vetting of a known set of schemes rather than evaluate the domain of potential names and block harmful ones like existing well known schemes or attempts at typojacking.

Let's revisit this and see which one works better for the web platform.

cc @annevk, @domenic, @mgiuca