Please continue this discussion on the internals list, this bug tracker is not suitable for extended discussions that require going through the RFC process.

As to how this could be used for HTML,

Start with the Template defined as a literal, and variables supplied separately:

<?php

  $template_html = '
    <p>Hello <span id="username">?</span></p>
    <p><a>Website</a></p>';

  $values = [
      '//span[@id="username"]' => [
          NULL      => 'Name',
          'class'   => 'admin',
          'data-id' => '123',
        ],
      '//a' => [
          'href' => 'https://example.com',
        ],
    ];

?>

Then the templating engine can do the necessary checks, and be certain in knowing that the HTML string itself is safe:

<?php

  function template_parse($html, $values) {

    if (!is_literal($html)) {
      throw new Exception('Invalid Template HTML.');
    }

    $dom = new DomDocument();
    $dom->loadHTML('<?xml encoding="UTF-8">' . $html);

    $xpath = new DOMXPath($dom);

    foreach ($values as $query => $attributes) {

      if (!is_literal($query)) {
        throw new Exception('Invalid Template XPath.');
      }

      foreach ($xpath->query($query) as $element) {
        foreach ($attributes as $attribute => $value) {

          if (!is_literal($attribute)) {
            throw new Exception('Invalid Template Attribute.');
          }

          if ($attribute) {
            $safe = false;
            if ($attribute == 'href') {
              if (preg_match('/^https?:\/\//', $value)) {
                $safe = true; // Not "javascript:..."
              }
            } else if ($attribute == 'class') {
              if (in_array($value, ['admin', 'important'])) {
                $safe = true; // Only allow specific classes?
              }
            } else if (preg_match('/^data-[a-z]+$/', $attribute)) {
              if (preg_match('/^[a-z0-9 ]+$/i', $value)) {
                $safe = true;
              }
            }
            if ($safe) {
              $element->setAttribute($attribute, $value);
            }
          } else {
            $element->textContent = $value;
          }

        }
      }

    }

    $html = '';
    $body = $dom->documentElement->firstChild;
    if ($body->hasChildNodes()) {
      foreach ($body->childNodes as $node) {
        $html .= $dom->saveXML($node);
      }
    }

    return $html;

  }

  echo template_parse($template_html, $values);

?>

I've written this up as an RFC:

https://wiki.php.net/rfc/is_literal

And mentioned it on the internals list.