Eleanor Terrett reports the SEC's tokenization exemption hinges on "public and permissionless," and nobody's sure where that line sits. I'd count XRPL since anyone can run a validator. Most nodes use a default list though. Your read?