Capabilities themselves are very simple, but they turn everything people "know" about security upside down. A lot of people look at them and say "this is too simple to possibly work."