Currently, we write out control chars to XML. That's invalid XML. Need to escape those. Can be in a feature tag, or name table, or CFF, etc. Test for example with Salsa-Regular.otf from googlefontdirectory.