[chbint]

> Qubes is a good approach to an OS, but it's Xen security, not OS security, and I'd rather run a secure OS other than Fedora or Debian on Qubes.

Not sure what you mean by "Xen security" in contrast with "OS security". Qubes is an OS. Though a lot depends on your threat model, if you have high security needs, Qubes is likely to be your best companion.

Anyway, another reasonable choice is Kicksecure. It's the debian-based OS underlying Whonix (Kicksecure is focused on security and Whonix adds its privacy/anonymity setup on top of it). You can use Kicksecure as a VM within Qubes, by the way.

https://www.kicksecure.com