I did. There’s a very reasonable threat model in which KVM or Hyper-V or bhyve or Xen is inadequate and an air gap provides stronger protection. But that’s no

I did. There’s a very reasonable threat model in which KVM or Hyper-V or bhyve or Xen is inadequate and an air gap provides stronger protection. But that’s not my point at all. Many uses of computers need to interact with potentially untrustworthy data, and make uses need to interact with untrustworthy transports that carry trusted data. An air gap is of little value if nothing can cross it. (Yes, some sets of threat models and design criteria allow data diodes.) If I had a nation-state budget and wanted to get data across a gap, I would look toward a deterministic, formally verified VM. This is quite practical — a very simple, small VM can run an emulator that can emulate x86 or ARM. And I would also consider an air gap. But keep in mind that an air gap does not protect against persistent compromise of the thing on one side, whereas a formally verified VM does.