Spec:

• https://w3c.github.io/trusted-types/dist/spec/

Code:

• components/script/dom/webidls/TrustedTypes.webidl
• components/script/dom/trustedtypes.rs

Tests:

• ./mach test-wpt tests/wpt/tests/trusted-types

This specification is partially upstreamed into HTML already (whatwg/html#10199) and in-progress for DOM (whatwg/dom#1268)

I discovered that the current IDL type of Element#setHTMLUnsafe currently takes in a DOMString html rather than a (TrustedHTML or DOMString) html: #36240 (comment)