> it limits what you can do Yep. For example you have to basically air-gap your software, no input/output, especially nothing that touches crypto/TLS/networks/

> it limits what you can do Yep. For example you have to basically air-gap your software, no input/output, especially nothing that touches crypto/TLS/networks/protocols, usually no support for fancy file formats either. Or you can just go ahead and implement all those by hand. Perfectly. I mean it's possible, but bumping BoringSSL/Libre/OpenSSL version every few months seems easier. ¯\_(ツ)_/¯