If you want to go extra ham on security, get a laptop with an open source bios (core boot). System76 laptops ship with coreboot Linux.