[jolux]

> I'm not saying I'd run it (I would not), just that I can see why they have a lot of kernel-resident code.

What would you run instead, or is there a different way of thinking about the problem it addresses that obviates the need?

[fsflover]

Not the parent, but security through compartmentalization seems like a more robust approach. See: Qubes OS.