Don't escape messages twice
They're escaped once by ->escaped(), and then escaped again by Mustache ({{double braces}} do HTML escaping, {{{triple braces}}} don't). Change ->escaped() to ->text() so that only the Mustache escaping remains.
Thanks to Niklas Laxström for reporting this.