Sigh. Qubes had some great security design and implemented it the only way time/funds would allow: by cobbling together a lot of unfortunately very complex and broken things built for a different security model decades ago.

Qubes is the least bad option for laptops (until Stagex Work ships which I am designing) but there is no reasonable server OS.

I am ripping off the best ideas from xen/Qubes and starting over with: https://distrust.co/blog/enclaveos.html