Replace covenants with multisig and realize that these 'attack surfaces' already exist. With covenants, the encumberance is coded into the recieve address, which you create and issue to the sender. The sender cannot suprise you with being in a covenant. Same with multisig, they cannot force you to withdraw into a multisig, but ofac compliant cbdc coin is possible (and easier) by only allowing withdraws into a multisig, whose second signer would only sign txn after checking with a gvt sponsored allow/block list... No covenant required