@technoprenerd The kernel is some tricky business.
It's a mix of the old linux-hardened (now maintained by anthraxx), mitigations from #KSPP, #CLIPOS (now unmaintained), @whonix, and a few other sources.
I'm sure there are a lot of configuration tweaks to improve depending on your system, but seems really strong for a "one size fits all"