I use QubesOS with detached boot partition on 2 duplicated USB drives with any data that rests on the SSD/HDDs being encrypted with LUKS2. Whonix gateway is proxied through a VPN qube to hide Tor IPs (can't hide communication patterns) without bridges since bridge IPs can be farmed. Sometimes Tor through I2P outproxy or vice-versa or with different anonymizing network overlays. Clients used for browsing are only opened in on-RAM ephemeral qubes with no access to permanent storage. Attack surface is quite minimum since no extra things added like USB mouse and no PV qubes (aside from sys-usb and sys-net) are used for launching HVM qubes with qemu stub domains unless very necessary and every other qube on the system gets shut down first to keep information leakage minimum. A veracrypt volume with hidden storage on a permanent qube for data storage and plausible deniability.what's your setup like?
