So getting rid of speculation entirely, and stalling on every branch, would waste time equivalent to dozens of instructions. On typical code that has a branch every few instructions, this could slow down execution by several times.
What architecture would do that, and how?
https://github.com/xoreaxeaxeax/movfuscator
add %rax, %rbx
add %rcx, %rdx
Have any of these bugs been completely based on speculation, or is it always speculating across privilege boundaries? (Although I feel like even the former isn't same, e.g., if you're in some form of VM attempting to maintain privilege separations.)
Intel does more speculation, but you won't find anything beyond the tiniest embedded CPUs which don't do any.