PNaCl is quite well documented. It involves LLVM bitcode and a verifier to prove it doesn't do anything naughty.

Requiring HW virtualization would defeat the purpouse of portability. It wouldn't fly on desktop or Android because of the HW and OS requirements.