To provide a truly secure laptop one need to control entire stack of software, which means OS verifying kernel module signatures, no third party software, BIOS

To provide a truly secure laptop one need to control entire stack of software, which means OS verifying kernel module signatures, no third party software, BIOS verifying OS and MBR and TPM verifying BIOS (unless it's made truly read only which would probably require custom chip these days). Anything else would be an illusion.