The classfile for a sealed type must have a `PermittedSubtypes` attribute, which enumerates the permitted subtypes.

PermittedSubtypes_attribute {
    u2 attribute_name_index;
    u4 attribute_length;
    u2 permitted_subtypes_count;
    u2 classes[permitted_subtypes_count];
}

reject classloading of subtypes of sealed type if not on the list
allow subtyping of final classes if the subtype is allowed to extend the sealed class
other issues to consider:
- The use of `ACC_FINAL` + `PermittedSubtypes` as a way to mark a type sealed;
- The form of the `PermittedSubtypes` attribute
- The approach used to validate subtyping