there are a fair number of scary papers about fpga trojans. it is very hard to verify fabbed silicon, driving folk to desperate techniques such as multi-fab comparison etc. on the capability / least authority theme, i am surprised no one has mentioned tahoe/lafs. one can build interesting things upon it. randy