The article briefly touches, and dismisses it, but this (and in fact, all of the audit support) seems like a prime candidate for trace points. No overhead cost

The article briefly touches, and dismisses it, but this (and in fact, all of the audit support) seems like a prime candidate for trace points. No overhead cost to anyone except those who want to enable the ones they care about, no custom kernels needed. These are already being used in many places to monitor/audit execution points not otherwise instrumented, so it's just a logical extension.