If you assume the machine will be compromised, is there any way around this?
Hardware security used to be a joke. Now verified boot, encrypted RAM, key storage in hardware security models and hardware and OS attestation are getting somewhere.
But if you're important enough of a target to a state actor they will magically have some workaround. For your average raid on your home they might actually work depending on the specific setup.
For really high threat models you want zero trust models with E2EE as well as staying anonymous so no one knows where the hardware (and the people which might be much more vulnerable) are located. Tor exists for a reason.
But surely intel services are smart enough to get people in there illegally.