I've actually given up on using laptops for now. I still have an old x201 and t400 but they don't get out much due to the Intel silicon vulnerabilities.

Nothing I do with secure data hard-requires that level of portability, and for insecure (tracked, DRMed, closed + signed firmware) mobile use a Lineage smartphone is good enough for what I do. A laptop with closed / signed firmware simply doesn't gain me anything worth having over the phone.

My personal desktop is a Blackbird. The couple of old x86 apps I can't easily ditch (because they are open source but need MVC APIs and I'm too lazy to write the shim layer) I just forward X over SSH to an old corebooted Opteron box.

Thanks for the thoughtful (and quick) response! That was sadly what I was afraid of. Normally I wouldn't bother but I'm going back to school, and sadly the Novena I have just isn't supported anymore (I tried updating u-boot/kernel myself for a while, ended up not being worth the hassle).

My best recommendation might be a bit odd, but here goes...

Can you put a POWER "base station" of sorts in your dorm / apartment and use a low power secure terminal, like a corebooted C201, to access it over an encrypted link?

I've done something like this when I had to travel last -- was able to maintain a stable link back to one of my POWER machines so the lack of local computing power on the laptop didn't matter. Really hate that Chromebook touchpad though. ;)

Heh, that's an interesting idea! I'll have to look into finding a C201. Finding a POWER base station shouldn't be too hard to find.

What OS do you run on the Blackbird?

I run Debian Buster.