This will allow calls like "qubes-dom0-update @XFCE"
This makes more clear which code have contact with untrusted data from VM.