what if there was a USB adapter that had a little chip in it that routed anything that passed through it directly to and from the sandboxed environment?
you could configure it with bash commands.
suddenly, you CAN trust that USB drive you bought at the market from a peddler