I recently learned about Sancus [0]. It provides a way to protect an application from the operating system. It requires hardware support though. So not available in any mainstream hardware right now. It also allows very secure DRM.

[0] https://www.usenix.org/conference/usenixsecurity13/technical...