(SELinux is enabled as of Fedora 39.)

> I would need to have a completely separate AppVM for each application and I don't think QubesOS was meant to be used like that.

I think that’s a decent starting point, actually. Not only that, but also separate disposable VMs for individual tasks, like reading a PDF.