Apparently they haven’t fixed it yet, so a hardware solution may in fact not be possible, but is there any reason to believe it couldn’t be patched in “microcode”?

Who can guess at the performance impact, but one could imagine a configurable mechanism capable of disabling speculation past a PAC authentication.