You can set up Fuguita via OpenBSD to actually lock all root access writes OFF.  In this case, the filesystem is read into memory on boot, then that filesystem is locked down for the duration.  No one can make any changes to the system from that point forward.  It could be run in QEMU and even lock down what drives could be accessed with the dd command as well.  This makes any kind of attack, absolutely impossible.