When showing links (e.g originating from markdown, but really any html output) we should do something about links that could be misleading. For example with <a href=https://evil.com/>sourceforge.net/auth/</a> we could automatically append (evil.com) into the output so its obvious when its misleading.
We should also check for non-ascii domain names (IDN) and if they have chars that are potentially confusing with normal ascii, then show the decoded domain name (even if the link & text match, if the chars could be confusing)