Turns out the 2 JSON structures enable safe entity expansion just like twitter entities.

In my reply contexts I am not wanting to embed 3rd party HTML in my site, so I take the p-summary and strip tags. But, I want embedded h-cards to be expanded just like at-mentions on twitter. Pseudocode:

let h-card = canonical JSON structure for a note, with .summary as a plaintext representation of the content;

for item in h-card.children:
 if not in_array('h-card', item.type) continue;
 let html = HTML representation of the child from properties.url, name, etc;
 replace item.value in h-card.summary with html

Example here.