Has anyone imported the workaround on a cluster and had either or both of these occur?
just imported the XML on our A/P cluster, no problem, no switch/-failover.
The success of the blacklist ist viewable on "Status - Activity":
5 patch(es) are configured for rejecting harmful URL's.
After running the integrity check tool...
...which has to be done on each node, a normal reboot of the current node is executed.
This leads to a normal cluster failover with the used settings (ARP-Timeout + 5 seconds AFAIK).
Thanks! Same experience here, but would have run the import sooner during Busness hours if had known through comments in the SA that the end-users would not be affected.