I think that for secure software it's more useful than ever to measure, minimize, and verify the TCB. State a security goal (e.g. "my screen will show 'From: Alice' only for messages from Alice"); restructure software with a tiny nucleus enforcing this goal against all other LOC.