I don't think there is a massive amount of software required. The linked module above is just over 2k lines and compiles to around ~250kb in size. Clearly not all of those things you mentioned. All you need is the a implementation of the wasm state machine. Keep in mind this is WASM not javascript, and not asm.js. Its a entirely new platform independent specification for a byte code.
I would wager to say a implementation in rust is far safer than all of the code that goes into today's linux kernel to run non wasm binaries.
You linked me to TCB, the entire point of the the OPs link to nebullit and cervus is that with this new strategy a entire new security module and way to think about and run un-trusted code has come about. So linking to old ideals and papers explaining how computer security works today only can be used as how things are done now. When the talk about running in ring 0 comes up they are challenging those very ideas. And doing a good job of showing how it can safely be done.
Baring bugs -- yes bugs can happen -- in both the old way and in the new ideas being tossed around with wasm they both are able to provide a level of security. One relies on hardware that can't be easily changed (microcode, new cpu...) , is hard to audit -- and in some cases impossible to audit.
The new notion of compile time checking with wasm allows for a clean approach to ensuring bad programs don't crash the system. Because it does not rely on hardware, but code it can be updated and audited.
I am not arguing that somebodies show HN fun toy is going to be better than 50 years of progress. But I am arguing that a few good years of investment can jump us past those 50 years into a new age of computing, not bogged down by legacy cpu architectures.