It snapshots / pauses the entire unikernel instance after launching chromium, and then resumes the instance in <20ms with exactly the same state.

Is that safe? I was under the impression that snapshot/resume of ex. anything running crypto libraries was a minefield of duplicate keys and reused nonces.