You can't stop all speculative leaking without sacrificing a large amount of performance. But you can stop all leaks across security barriers with a very modes

You can't stop all speculative leaking without sacrificing a large amount of performance. But you can stop all leaks across security barriers with a very modest performance cost. This still leaves web browsers with a hard task in terms of isolating Javascript but it solves the issue for, e.g., web hosting services like the OP.