Thanks, that seems to align with what I understand too. But I thought perhaps a new architecture, like M1, would have had some additional protection.
Just looking for a way out of the mitigation quagmire for people/orgs who own the hardware and don't share it with external untrusted parties. For all the talk about threat modelling, everyone seems to think we all want -20% perf on the whole machine, while only one or two processes do net I/O...