[tptacek]

The heavyweight host (which is the normal state of affairs) is problematic attack surface; moving the workload into a hardened VMM on that improves security regardless.

[touisteur]

Thanks Thomas for the insight.