[webappsec] UISecurity input protection: same origin or same document?

The current input protection heuristic says that repaint events or
obstructions caused by a different document trigger a violation.

As it is likely that user agents may composite together rendering of nested
iframes from the same origin, are there any objections to weakening the
heuristic from being same-document to merely same-origin, to avoid another
implementation barrier here?

-Brad