I wouldn't trust them. One might mitigate a bit using the classic patterns against side channels: randomization and masking. I came up with an idea for randomiz

I wouldn't trust them. One might mitigate a bit using the classic patterns against side channels: randomization and masking. I came up with an idea for randomizing execution at CPU level but the person that beat me to it patented it. Possibly something like ARINC partitioning combined with randomization plus operations similar to those that process secrets, but process fake data. One of the simplest methods, though, is focusing the leak-proofing on the barrier between partitions handling secrets and everything else (esp w/ comms capability). Then, you just make sure you have trusted, hard-to-hack code on as much of the system as possible. No web browsers and such. Safe, system language with pointer and overflow protections along with performance hit that comes with. Otherwise, back to physical separation. I used that with KVM switch back in the day.