Hmm. How about having a firewall consisting of two distinct servers placed in series, one made in the US and the other made in China, both running some open-source OS. I know, the surface attack is still huge but at least you are not automatically and completely open to a single three-digit agency.

Edit: oh, you'd have to import the Chinese one yourself into the US to make sure it doesn't get its firmware "updated" somewhere in the suppliers chain.