Wouldn't the XMR-based software options fall into the same risk categories? I'm thinking Retoswap or the like. If someone has to actively maintain them, then they're running a legal risk of being exchange operators, at least in the EU, right? I wonder what a bare bones piece of software for Bisq or Retoswap would look like and if what you're proposing is possible?