I listened to an interview with one of the researchers. They had a component to verify "this binary will never allocate mem outside it's allowed area" and by statically verifying that they could enable high performance IPC. Also, that was the source for the decision to allow it to run on Ring 0. That's what stuck in my mind.
Thanks, that was fascinating! I also see that Galen Hunt contributed to Windows Phone, which I adored. (Maybe I'm quixotic, maybe I'm a poor picker, but i love a thing that's beautiful and doomed.)