Finally, you're recommending this to be in the kernel. I agree for the most part, however this should be as an extra layer. The more layers, the merrier! One known example is Dirty CoW which don't work under Syd or GVisor.

Also this, https://news.ycombinator.com/item?id=41005936, lulz!