I'm an old man, here's an old man answer, that might seem silly, but gives you a direction you might be able to pursue with more modern hardware, let's say a US

I'm an old man, here's an old man answer, that might seem silly, but gives you a direction you might be able to pursue with more modern hardware, let's say a USB bootable computer. (It's too bad you can't truly write-protect a USB drive, though) == old man answer begins == The most secure model of computing, that I'm aware of, is to use a non-networked computer without any permanent mass storage, booting off of "trusted" read-only media. Such as an IBM PC/XT with dual Floppy disks. We used to buy software on "Shareware" diskettes at user groups, coming home with dozens of disks of totally untrusted software, then spend the next month trying things out, and repeating this every month, for years. We did it in almost perfect safety, because we had a simple way to copy our boot disks, and our data disks, that was proven and reliable, and easy to grok. You ALWAYS knew what disks were at risk, because they were the ones without write-protect tabs on them in the floppy drive. If you had any sense at all, you had multiple copies of your critical data and boot disks. You could always recover to a known state in a few minutes time, no matter what. The hardware didn't have any place large enough to store virii, etc. == old man answer ends == If you have to be super-paranoid, get a stack of USB disks, and a "known good" boot disk (thumbdrive), and a computer that can boot from USB with no persistent storage. Make a stack of copies of your boot media when you get your configuration settled. Use them only once, like pens used in public during Covid. Use a second disk for your data. Treat them all like we used to treat floppy disks, but with the additional caveat that you CAN NOT EVER trust any "write protection" of USB sticks. As for OS choice, Edward Snowden used to recommend Tails[1] as an OS boot choice, I'm not sure if that's still the case. [1] https://tails.net/about/index.en.html https://tails.net/about/index.en.html