@ze I've thought about this a bit, and on balance if I really were at serious risk in the way some journalists/activists clearly are, and I had to travel with my Qubes laptop then the best setup might be the boot/header route + stateless + remote backup and then ditch the local flash backup.

Ultimately, you could walk away without the laptop/flash drive and restore everything at another location on new hardware.