You _can_ do it with libreboot on ancient thinkpads, but it requires a decent time (or money) investment and some know-how. https://libreboot.org/docs/gnulinux/encrypted_trisquel.html