Indeed, you always need two channels, one secure to a trusted computing base and one for the rest, whenever you might be dealing with potentially malicious prog

Indeed, you always need two channels, one secure to a trusted computing base and one for the rest, whenever you might be dealing with potentially malicious programs or data. This is true if window systems/UI as well. I first saw this discussed in the EROS trusted window system, and you can see similar things in Qubes. Conflating data and commands/ instructions has a long history of security problems in von Neuman architectures.