Slightly trust Intel-CPU Chromebook hardware.

I have yet to become allergic to Google snooping but understand that lack of trust to be very well founded. I think I understand their secure boot architecture, though. Whereas I simply cannot trust Windows Secure Boot based vendor firmware.

Apple iOS devices. Their macOS Intel computers are about as trustworthy as Chromebook Intel.

Not-so-recent ThinkPad laptops with OpenBoot BIOS are ok.

But.

All of these devices have radios with each their own, black-box operating systems. I don't know how to develop a basis for trust there.

So I am left with very few alternatives.

A Raptor Talos II Workstation, with a custom battery-based power supply, locked inside a Faraday cage. Turned off.

https://www.raptorcs.com/content/TL2WK2/intro.html

Librem is probably the most trust worthy at the moment.

System76 ships laptops with Intel ME disabled and provides an open-source firmware update tool. I'm a huge fan of them.