If your threat model includes getting hacked by the government, then your only choice of OS would be some hardened open source OS with fully reproducible builds and no proprietary driver blobs installed.