Comment by api

Complexity is evil in security, and opt-in security generally doesn't work. SELinux is both complex and opt-in.