It certainly is an improvement. But my point was that it still leaves a whole lot of attack surface. If you want a provably secure system, you basically need t

It certainly is an improvement. But my point was that it still leaves a whole lot of attack surface. If you want a provably secure system, you basically need to verify much more than "just" the kernel. On the upside, if one did so, it would have benefits beyond security.