Or just use the existing hardware security features that don't let the OS see what's in the relevant video memory at all. But as you say, that's a much, much s

Or just use the existing hardware security features that don't let the OS see what's in the relevant video memory at all. But as you say, that's a much, much smaller attack surface than trying to validate the OS.