I’m pretty hardware and OS ignorant but….

Two physical machines in 1.

Internal Machine 1 - Node

Dedicated SD slot to read latest PGP signatures.

Dedicated SD slot to read latest node release package.

Hardware restrictions so the node software can only be loaded from the SD slot if the signatures in the signature SD slot verify.

Separate motherboard and fast fast SSD from vendors that are not closed source.

Cut down OS that only enables system calls required by the compiled node source code.

Dedicated bus to Internal Machine 2

Internal Machine 2 - Electrum

Smaller but fast SSD

Hardware restrictions on network port so only the 50001 port is exposed.

Ok bored myself