... then there's Qubes OS, which beats the pants off AOSP isolation using Xen. Feels like the labelled desktop of the Trusted Solaris days! If one wanted to utilize SELinux in TemplateVMs for further hardening, that is always an option.