Doesn't it just mean that both sides have to maintain postMessage() handling? Just like host and iframe with different origins. Google will not be able to receive any events/messages unless they're sent by not-google.com. That's what I understand from it, please correct me if I'm wrong.