Given that the security "zone" varies based on the TLD, how will the new TLS be handled? For example: A browser may permit cookies to be shared and SSL certificates, and wildcard certificates ...
Imagine example.com that is accessible via HTTP and HTTPS. Most of content at site isn't secure and it won't be bad if it will be read by attacker. One of paths - example.com/secure_zone is accessible ...
I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...