It seems vmware is doing some interesting stuff on this level. I've
seen it reported (but I can't personally confirm it) that you can run
OBSD inside their vm. The enterprise class vmware solutions allow
resource management for multiple vm's. You could set each user up with
their own vm of OpenBSD and not need to worry (as much) about the what
their cgi's could do to the system. If they crash their own vm, it
shouldn't affect the whole system and the other vm's running on it.
It's just a thought... but seems like a reasonably simple way to
handle the resource management and security in one fell swoop.