I thought that in the wake of Spectre etc, the CPU vendors declared that they wouldn't support privacy guarantees within a process, and that only process sandboxing would be supported?