Potentially, although it might need quite a lot of infrastructure to make that work usefully I think, as most of the design in Capsicum has been around reducing

Potentially, although it might need quite a lot of infrastructure to make that work usefully I think, as most of the design in Capsicum has been around reducing capabilities for a single group of programs for security, not a whole system. You can do much of that with Linux capabilities now - see man (7) capabilities and the section "The securebits flags: establishing a capabilities-only environment" which says how to disable suid so root is effectively removed.