I think this is a nice project but i wonder what exactly is verified vs. verifiable concerning the hosted linux kernels. its great if the HV is verified but verifiable and linux kernel in some VM are hard to combine in a sentence for many ppl.

Also wondering a bit how your HV looks at DMA capable devices. does it restrict DMA apertures based on some policies or so in order to ensure they can only write/read certain places? how is that managed if so? theres multiple angles where TPM/secure boot might not be enough. you can use iommu and things like amd-vi to highly restrict these types of devices and interactions.

other then that super cool project really. Like to see a HV being built on Sel4 its a very nice base to build up from if formal verification is your goal.