>>37
I use a Librebooted laptop with Debian that has FDE enabled. I also have a GRUB password set up. Works well enough.

If you're going full tinfoil, then use a Librebooted machine with an OS you've made yourself and remove the networking hardware. Encrypt with Twofish to make brute forcing harder for the attacker.