Better, have a secure server at home and ansible playbooks to set up laptops (including getting any minor secrets that you need onto that laptop. Restrict more important stuff to just ssh).

If your threat model doesn't include physical tampering/rootkits, just wipe your devices pre-travel and set it up when you get where you're going. If it does and you can afford to mitigate that risk, arrange to have cheap new devices at your destination and travel with nothing.

If you're going that route, why not just create a disk image and scp it from your server? Certainly a lot easier than trying to rebuild everything from scratch.

actually I'd find running my ansible playbook much, much easier than transferring GB of disk image about. I maintain the playbook so that I can keep work laptop and personal laptop in sync. Although I am looking at Nixos as a possible replacement.

An ansible playbook gives you much more flexibility to get to the same place. The one I run takes a mere 3-5 minutes to run (typically) regardless of where I am in the world.

Would work if you trusted that the devices weren't tampered during inspection. Why would I put my keys on something which might've been wiretapped? If you really need to compute whilst traveling or through the states, just buy something cheap whilst you're there.

I literally suggested that if you read my comment.

Nah , just backup and then wipe all your devices and then restore them after customs. (Kevin mitnick does this).

Or, perhaps he says that but has two passwords, one that decrypts and runs an OS and one that presents as if no OS is installed?

They can seize your stuff so your workaround won’t work when they pass it to their tech team for forensics. Also, if they find something now they have you lying to customs.

It seems (ha!) possible to design the logic for such a system with deniability, like the system has to use the second/third/fourth password to attempt decryption before you know if the padding is encrypted or random noise [if the specific encryption has a signature then each install could encrypt the empty space with a few keys taken from urandom].

First password accesses clean files, second one accesses dummy [legal!] fetish porn collection ... do border guards hold you to get a third password?

An analogue analogue might be: I have a book full of "random alphanum text", I have two (or more) one-time pads for decryption of portions of the book, I also know the page/line the actual cyphertext starts at. The rest of the text in the book is random quotations encrypted using a selection of further random one-time pads. Can forensics find that there is a "hidden" n+1 plaintext when I give them the n pads and starting points? Seems impossible??

You still are now attempting to deceive a government official. Also, you are assuming that the technician assigned to you wouldn't be able to figure this out.

Also, sweating you out in holding is probably more effective than you realize.

How do you find a rented laptop trustworthy?

Although it may not be morally ok, one could just buy a laptop for a conference etc, and then return it after a week if the store has a return policy. I've seen stores take back laptops no questions asked for up to 60 days.

If you are in a pinch.

If not you can just sell it (there or at home) and take the loss as a rental fee.

Why wouldn't a rented laptop be trustworthy?

Because it's someone else's hardware, someone else's software, and someone else's firmware.

To be pedantic, unless you flashed coreboot it's not your own firmware and if you aren't using an open hardware laptop then it's not really your hardware either.

But you can have a bit more trust in the supply chain to get to you than that it hasn't been tampered with afterwards.