I don't want the OS to talk to anywhere except for a clearly defined, lean, verifiable process that fetches security updates.

That's why I use Debian. And hope they do the right thing.