Mizapf bypassed a lot more of the core than I was expecting, so we may or may not get standard behavior with .rpks. Separation from the ROM data doesn't seem possible - at best you could put the xmls in the AES.zip with the *other* illegal rom data.