Thanks. I haven’t looked at WPE, under the assumption that using an existing toolkit would be easier (especially when it comes to interaction with the GPU). Maybe it’s worth a look.
I have been using a Qt port of the tip of the WebKit development branch (at least as of a few months ago), which the WebKit developers confirmed is supported and has all the necessary security fixes. The “legacy” part (a.k.a WebKit1) means it doesn’t use separate processes for sandboxing, but is otherwise up to date.