QubesOS had the right idea. You want layers and layers of security, with multiple VMs at the root.