Sure, defaults matter. My point was that when talking about commercial security offerings, the security models generally end up relying on on "trust the compan

Sure, defaults matter. My point was that when talking about commercial security offerings, the security models generally end up relying on on "trust the company", which has never worked out well. So corporate offerings finally coming around to having full disk encryption is more catching up with something they lacked, rather than advancing the state of he art. (Contrast with Android's process sandboxing, which seems like a genuine advancement and could be worthwhile to port to desktop Linux) In the context of talking about individual actions one can take to trust their personal machine, it's reasonable to assume this involves appropriately configuring your software environment. If this was instead a thread about what products would be good to recommend to your parents, then what was commercially available off the shelf would be relevant.