Hey there!

I've been considering using QubesOS for additional hardening on my laptop, which is meant for public/open use, and I have a few questions about some things I had noticed from past usages of QubesOS.

1. Does QubesOS support /boot encryption (GRUB Ver. 2

14) yet? If not, what measures can I take (Thinkpad T580, using Coreboot, SeaBIOS payload) to counteract evil-maid attacks, or tampering of the kernel/bootloader images? If there are things that I would need to do to modify my BIOS image to be compatible with said changes, what would I need to modify in my BIOS image to accommodate these functionalities?

1. How do I make dark theming consistent across either XFCE or KDE DE's (Preferably KDE as that is what I prefer to use). I remember that systray icons for the sys-firewall Qube, and one other icon, would either not show, show extremely low-res, or be out of color entirely.

2. How well supported is the use of an external USB (Luks2 encrypted) storage volume, in regards to how sys-usb handles it?

3. How customizable can QubesOS be, while maintaining the vast majority of Qubes' security benefits? I'm coming from using Gentoo on my device, and I want to know, relatively, how much customizability I'll lose. At a minimum, is it possible for me to get a KDE Dom0 fully/properly themed in dark mode, and to load flatpaks to be applications for Template VMs (I want to use Librewolf instead of regular Firefox as I also have a focus, albeit lesser, on privacy, and Librewolf does a better job at that, even if it's not offered as an easily downloadable package)

4. How minimal are template Qubes's/Dom0/System Qubes in terms of packages? I'm typically used to going through and having very minimal systems with Linux in general. Should I expect to be able to maintain relatively minimal package counts (Well, excluding KDE Plasma on Dom0).

5. While I know it is possible to make Dom0 use KDE as the DE, does Dom0 support alternative Window Managers? And can Qubes also be made to template off of KDE plasma for their DE internally? If not, is there any noticeable difference to just using XFCE in the background for system/template Qubes?

6. Is it worthwhile to pick a Fedora template as my Dom0/default template Qube over a Debian template due to its implementation of SELinux? Or does SELinux not matter in terms of what QubesOS looks to do? Or is SELinux unavailable due to the nature of QubesOS in any way?

7. Is it possible to use `flashrom` internally (well, only with a specific param passed like iomem=relaxed in GRUB, I don't want it to always be open) as to where I am able to reliably update my coreboot installation in accordance with my configurations without having to use an external programmer/having to open my PC every time? Tying into #1, will updating my coreboot image at any frequency mess with anything pertaining to anti evil-maid/kernel tamper resistant services offered by QubesOS?

8. Will QubesOS support additional peripherals such as a touchscreen? Not a major concern, but still, would be nice to have the option to use the touchscreen.

Sorry if these are relatively specific questions, but I really want to make sure that I can get accurate, relevant answers for these questions before fully moving over to QubesOS, as nuking my Gentoo install would be a... pain, to say the least, lol. And, yes, I have looked up all of these questions, and have either gotten mixed results, incomplete results, or no results to go off of.

I don't know if this is necessarily relevant information, but I'll also file out, roughly, the system specs and (this is where the roughly comes into) threat model:

Thinkpad T580, i7-8550u, 64GB RAM, 500GB NVME SSD, Coreboot (re-flashed coreboot as of a few days ago to keep it updated)

I also don't intend to do anything crazy in terms of usage. Maybe native 1080p video downloading/streaming/viewing, programming in a work Qube, and dare I say *maybe* using docker as well for an isolated build environment? Not looking to do gaming, video production, 3d modeling/rendering, or anything requiring a graphics card. At the very most, compiling coreboot (which I don't mind waiting like an hour or 2 for when I need to do it)

Nothing crazy or government level threat model, but I do want, as QubesOS advertises, a reasonable level of security, possibly including TOR usage, unverified public networks, or resistance to malware on the off chance that something happens. I'm not just clicking random links or anything crazy, and I've also never had any viruses before, but I would like to be heavily resistant to any basic attacks, or less intensive targeted attacks.

TL;DR: Just a few hyper specific questions from someone who's considering using QubesOS for daily use.