The template file I’ve uploaded has all proper html escaping, but the code validator incorrectly reports it as unescaped and the client renderings I see seem to have the characters unescaped.
I tried both the file upload and the copy/paste method and the result is the same.
Is the template being modified before it goes for rendering into the different email clients?
I tried to attach the email but it seems to think the html file is an image type. Well looks like 2 bugs :D