A totally encrypted filesystem would be a nice option....enter a key at the bootloader stage just like other linux distros.