Comment by chc4

CHERI is a research project currently. It has a number of large outstanding issues - CHERI essentially needs to do a whole-system stop-the-world garbage collection phase for precise tag revocation in order to avoid non-stochiastic temporal safety, iirc, which is alluded to in the OP as the "revoker" (google "CHERIvoke sweep") - and is still under active research. It is not something that can just be rolled out to production on one of the highest profile devices in the world. Porting code to run on CHERI, especially if you want to actually use the security features it provides, is also a large undertaking, and would be a massive userspace change. Apple is doing a lot of very good work in similar spaces, between PAC and FireBloom and related security measures, but there's a very big difference between that and CHERI.