I’d like to propose discussing a path toward upstream Common Criteria certification for Xen. While this is highly relevant for mixed-criticality edge and embedded systems, it also brings immediate value to the server virtualization ecosystem. For cloud providers / distros, an upstream CC baseline provides formally verified proof of tenant isolation, etc. It also acts as a critical enabler for server vendors competing for government, defense, and strictly regulated enterprise deployments where CC is a hard requirement. Doing this work upstream significantly lowers the compliance burden for everyone downstream.