you want your kernel to do that because it's the source of truth. And what if you want to audit execution that includes binary blobs you don't own the source of?