What about a kernel module that on every open() looks if the file has "<VirtualHost" somewhere in it, and rewrites the configuration to something safe on read() in this case? This wonderful piece of technology would need to be closed-source, of course.