My response wasn't about the kernel issue, I was referring to your assertion that there is "no way for the OS to prove that the PAM stack hasn't been replaced".
But there is, since the OS can execute processes in parallel with the PAM stack (e.g. init, sulogin) which can independently observe it.
Re: assumption of innocence
But there is, since the OS can execute processes in parallel with the PAM stack (e.g. init, sulogin) which can independently observe it.