the problem with security is that being too secure gets you on a list, unless it's part of your job.

The other problem is stuff like the Intel Management Engine. You could buy a CPU or laptop with it disabled, but the NSA can collaborate with Intel to easily produce pretend-old CPUs and laptops with a pretend-disableable IME and sell it to people like System76 as if it's actually old, disableable CPUs/laptops. There's no way to tell the difference between these modified CPUs and legitimate ones, and both surely get you on a list.

i'm open to discussion about this. i'll be glad to be proven wrong.