I find the implementation very compelling too - it uses kernel support. That really simplifies an otherwise very complicated and security-sensitive code path.

You could also use `doas -s`, see doas(1)