Sealed Capability Types for CHERIoT / hacker news