>> make everything executable immutable

> How though? Presumably you mean we should trust the OS to do that?

If you don't trust the layer controlling the hardware (aka. the OS) then you need to do that in hardware.