AEM is a little sketchy though, you need to trust a flash drive to hold it, and make sure that drive doesn’t get overridden by a malicious attacker. Your link goes more into depth about the disadvantages

In some threat models, it's more feasible to protect a portable flash/SSD drive than an entire laptop.

In other threat models, laptops/tablets/phones could be physically secured in a safe, or kept under direct physical supervision.

Yeah, that’s what I was alluding to. I think the OPs point still holds here- both of those are quite a bit harder than the built in Mac solution

How about Heads?

https://osresearch.net/

https://forum.qubes-os.org/t/what-makes-heads-so-great-when-...