It doesn't look like they store data on the shadow stack, just return addresses, so it wouldn't take double the time. It does look like it would take double the

It doesn't look like they store data on the shadow stack, just return addresses, so it wouldn't take double the time. It does look like it would take double the stack space (and depending on how small your function stacks are, double the cache), but the flip one bit implementation definitely isn't the only way to do this. This is actually pretty reminiscent of how WebAssembly handles stacks. The "real" WebAssembly stack for both local variables and return addresses isn't even within the sandboxed memory addressable in WebAssembly. For values on the stack that require something more sophisticated (e.g. ones accessed via pointers) compilers put them on a shadow stack within WebAssembly's addressable memory. Since WebAssembly doesn't even have an address for the other stack, it's inaccessible baring a sandbox escape, preventing it from getting corrupted and allowing an arbitrary return address.