This list is great, but what I find missing in these discussions is what to do about it.

And the answer is: if at all possible, only use a name for display purposes. Use a username, a UUID, or some other appropriate unique identifier that you can control the semantics of for absolutely anything for which you might need to assume any property whatsoever.

If you can avoid having a name, don’t even try to collect one. If you need one, it should be a single freeform text input accepting an arbitrary-length and arbitrary-content UTF-8 string. Persist that string exactly as you receive it. Perform no operation on that string other than rendering it.

That isn’t perfect but it’s as close as any of us can reasonably get as things stand today.