I wonder how long until the kernel is checking signatures on code pages as they're mapped into memory or modified (iOS style). Obviously no one wants the vendor gated platform lockdown aspects of any of this, but user-defined key whitelists for both kernel and userspace binaries would be really cool. I think I've heard Linus is not in favor of extending this notion to userspace binaries, or at least that he doesn't believe it should be the kernel's responsibility (for Linux anyway), though.