The other risk to consider, now that I actually have the time to look at the logs more closely myself, is whether Velocity is somehow accidentally defeating the purpose of CDATA by turning things back into real characters anyway. That would be unfortunate from a CSS perspective, probably, and maybe others.