- End qrexec policy with deny rules; - Move the USB setup from sys-audio to sys-usb; and - Document the pros and cons of the different types of USB devices assignment to client qubes or to the server.