Andrew and Amy's method makes the safety policy even smaller. Note the difference between a paper proof of type soundness for a kernel calculus and real verification of actual machine code before it runs. It sounds like you're not saying anymore that the key property is safety, but rather the combination of safety and performance. Code signing doesn't have much to do with determining fault. Of course, all this is speculation in the present legal environment.
Nobody cares about security.
Corporations do get burned, by viruses and things. They are the ones that set up firewalls and enforce security policies, not individuals. History shows that claims of dramatic speedups from new technologies are seldom borne out. Smaller TCB means less resource usage. Servers must provide multiple versions.