No.

LineageOS is a good step in the right direction GrapheneOS is the best, but obvously restricted to Pixela device due to their hardware.

Signal is not the answer. Signal’s backend is essentially closed-source, and to my knowledge none of their binaries are reproducible with the code available. If you really want privacy and security in E2EE, you want somethjng that’s completely open-source (front and backend), and can be self-hosted entirely. Matrix is this.

deleted by creator

This is why I recommended a Shield for which there is an actively maintained LineageOS. Yes, it’s an investment, but well worth it nowadays.

You VPN may have an option under settings called Split-Tunneling - Most well-established VPN providers will have this. This allows you to set the local subnet for your network, and it’ll bypass the VPNs so that local connections are local. Check it out. Otherwise, what you propose works, yes, as long as you’re okay with having that laptop as a single point of failure for your content. At least get an external drive and periodically backup to it as well, and have that drive elsewhere. Good enough starting point.

1. Invest in an Nvidia Shield
2. Install LineageOS Android TV

I have two of these in the household, one of the best tech investments I made. No more homescreen ads.

Thanks for the response, this makes sense I suppose. I personally like being explicit and knowing-at-a-glance what is currently configured, but I can see some defaults being useful for many beginners for instance, and keeping config cleaner.

This sounds interesting. But in that case, how are headers set? From a security and even privacy standpoint the correct headers can be quite important. How do you enable/disable http2 and http3?