Step -1: Forbid Linux Kernel Modules for security reasons

Step 1: Require OEM's userspace drivers to use stable ABI (Android 8.0-9.0) exposed over a bus

Step 2: Require OEMs to use your way of doing secure boot chain (Android 10)

Step 3: Require OEM's kernel-space drivers to use stable ABI, and force the usage of Linux Kernel Modules (Android 11 -- we already lost the GPL here)

Step 3b: Start implementing VM support. Find a nifty marketing reason to have VMs ("Privacy Core")

Step 4: Require OEMs to use your own signed kernel (Android 12)

Step 5: Have said micro-kernel load/exec original kernel's executables

Step 5: Say that for security's-sake, it will be better of the nifty VM if its OS is a micro-kernel

Step 6: Require OEMs that your own signed kernel also runs as hypervisor

Step 7: Expose bus defined at step 1 across the VM. Use it to move various components from original kernel to the new micro-kernel, "for security reasons"

Step 8: Have said micro-kernel load/exec original kernel's kernel-space drivers (stable thanks to step 3)

Step 9: OTA kernel defined at step 4 to new micro-kernel

Step 10: Extinguished.