I'm thinking a language change isn't enough... At least not for a kernel.

There has to be a pseudo userspace type of way to build a kernel driver. Basically, user space programs are fine, but kernel drivers need their own form of encapsulation without expensive context switches.

Something like memory encryption or memory access bounds. During the handoff you do not change the address space, you just restrict access to a subset of the kernel memory.

It's possible that we might need CHERI on stack pointers, specifically function arguments, because that makes it possible to grant a function access to a subset of the memory.