I plan to create an air-gapped laptop with a separate bootloader that is on a permanently write-protected SD card that I will carry in my pocket all the time.
I will also remove the wireless card on the motherboard. The only thing that makes me unsettled is the BIOS. It's a pretty old BIOS and doesn't even support UEFI.
I can't be sure about its integrity, so I thought, can't I just pour silicone to protect the BIOS chip? To prevent flashing new firmware I can just use a hard password.