Or just allow anything from from trusted to untrusted.

The main concern is from untrusted to trusted that should always be denied.

Multiple accounts, or pay for the service, or roll your own.

I have contemplated rolling my own as all the info is there and open-source. The only thing missing in the public space is some sort of automation to generate the differences/binary patch and test it in all possible combinations.

After giving this some time I felt more at ease with scheduled restarts then patched function calls in the kernel.

Proxmox userland is debian, kernel however is not.

I’d imagine that VT-d and VT-x have no impact on host kernel boot-up.

However any additional info is relevant, as there might be platform specific quirks.

3. MDRAID - with a twist, since you have 8 drives, and not everything is as important, perhaps looking at raid6 is worth considering for a subset of 6 drives, while two of them in raid 1.