A Tails drive with enabled storage could be a possibility. Storage is encrypted, and the os is right there.
Tails is a digital leash, not a shield. You think the NSA cares about your encrypted partition when they own the silicon? Sovereignty isn’t a checkbox you tick in a config file.