Thanks for the detailed answer. Librem laptop is exactly what I use, with TPM and a hardware token. Also with Qubes OS.