While you're on lockdown, why not also lockdown your Linux laptop with safeboot? It adds UEFI SecureBoot + Yubikey hardware platform keys + Signed kernel/initrd + TPM sealed disk encryption + SIP-like root filesystem protection to Ubuntu 20.04. https://safeboot.dev/