What extra layers of protection should I add for better security on Qubes OS 4.3?

[FranklyFlawless]

Okay, a few augmentations to Qubes OS security benefit from firmware and hardware (root of trust), particularily Coreboot, an open-source boot firmware. Qubes-certified hardware requires Coreboot among its certification criteria, but leaves the rest of the Coreboot payload implementation details up to the manufacturer. Currently, the situation is split into two mutually exclusive pathways:

1. Secure Boot
2. Measured/Sovereign/Verified Boot

@maltfield provided a detailed analysis of the benefits and tradeoffs of each approach in a blog article:

Trusted Boot (Anti-Evil-Maid, Heads, and PureBoot) - Michael Altfield's Tech...

Here are additional related topics:

Overwhelmed by conflicting hardware security advice

(Feel free to skip to the numerated questions if you don’t care for the context.) I’m looking to maximize both security and FOSS while trying to stay within a budget and avoiding extremely complicated systems such as manually hardened Gentoo. We may also assume that advanced persistent threats are part of my threat model. I think Qubes OS is a decent option for this criteria, and while I’m not an IT professional I am willing to learn. I’ve seen conflicting advice on which hardware and firmware…

Best Owner-Controlled Qubes Secure Motherboard Recommendations

Here in 2025, I am now designing the build for a new high security focused system, and so I’m seeking recommendations for owner-controlled secure motherboards (whether it be consumer, workstation, or server models) that work with Qubes OS. I have been out of the market for the last ~4 years, so I’m not fully up to date on knowing the present state of owner-controlled systems available, and am therefore seeking to receive thoughtful education, tips, recommendations, etc. Here’s what I’m aware o…

Thinkpads vs new laptops (Coreboot wise)

Could someone explain what is the difference in terms of privacy when installing Coreboot/Libreboot of using a good ole Thinkpad x220/x230/T480 vs a modern Coreboot laptop like Systems76, Purism, Novacustoms, Tuxedo, Star Labs etc (im not sure if there are more) I mean, beside the obvious fact you are using much older computers with the Thinkpads, are there any differences? I remember reading Thinkpads made possible installing firmware that had less propietary blobs with Libreboot, but apparen…

Currently, the latest in Secure Boot development is Dasharo TrustRoot, and the latest in Measured/Verified Boot development is Flashkeeper:

Dasharo TrustRoot: strengthen your platform security with Intel Boot Guard to...

flashkeeper