> Would moving the untrusted content to be served from a separate domain entirely close the hole?

Yes.