1. One or more non-transitory machine-readable storage mediums storing one or more sequences of instructions for transferring control to a bit set, which when executed by one or more processors, causes: associating a signed cryptographic hash digest to the bit set to identify a locally determined provenance of the bit set, wherein the locally determined provenance of the bit set is based, at least in part, upon the locally determined provenance of the software entity creating the bit set and the manner in which the bit set was created; and at a point of ingress, transferring control to the bit set by performing: prior to transferring control to the bit set, determining if the bit set is in a set of universally known malicious bit sets; upon determining that the bit set is not in the set of universally known malicious bit sets, determining whether the bit set is in a set of locally known virtuous bit sets based, at least in part, upon said signed cryptographic hash digest; and upon determining that the bit set is not in the set of locally known virtuous bit sets, then copying the bit set into a micro-virtual machine and transferring control to the bit set within the micro-virtual machine.