I do not know Extism, but I would start from the process of verifying the security of it, and highlight what allows to check it quickly and with certainty. For

I do not know Extism, but I would start from the process of verifying the security of it, and highlight what allows to check it quickly and with certainty. For example documentation of the sandbox and possibility to inspect all syscalls performed with verbose logging. These are just examples; basically I would put focus on minimal trust and maximum transparency.