Right, still can't filter reads. But you can allow kind 4 while the rest of the kinds are controlled by a pubkey list.