If you do it right, you only need to verify a few key components with interface conditions on how the rest should use them. This approach was taken in high-assu

If you do it right, you only need to verify a few key components with interface conditions on how the rest should use them. This approach was taken in high-assurance security to build window managers that prevented leaks between apps or login spoofing. Nitpicker GUI is a modern example of that at least architecturally.