Great, happy to see that you considered all of these options and everything you say makes sense. Speaking of Whonix, you may be interested in a recent discussion about hardening a Linux desktop [1]. Since Spectrum is designed to be compartmentalized using VMs, this mainly applies to hardening individual VMs, which is probably less significant than making sure the inter VM communication is secure, but nonetheless may be useful.
[1] https://forums.whonix.org/t/fixing-the-desktop-linux-security-model/9172