In HTML, <script> blocks have a CDATA context, and therefore <!-- and --> characters do not indicate comments. CDATA blocks are terminated at the first instance of the two character sequence "</".

This is the very informative reply I received from Ian Hickson. Making sure no </ occurred did make the validator happy. But then this passage in the HTML spec makes no sense to me at all. It's a dirty mess this HTML, hurrah for XML!

Later: I just figured it out. Older browsers don't know the script tag, so they also don't know it has CDATA content and they do see the comment as a real comment.

Ian Hickson pointed out to me that the HTML result of the XSL transformations isn't valid. I fixed most of the reported bugs, but the W3C validator still thinks it's not valid. Somehow it tries to parse the javascript code, which I put inside a comment. This seems like a bug in the W3C validator to me, or am I missing something?