It looks like you are searching for Qubes OS.

> I believe Qubes OS followed that approach but it was awkward, limited, had major performance problems, and yet never managed to fully prevent circumvention.

Not sure what you are talking about. Qubes offers reliable protection with decent performance, unless you work with graphics. See also: https://news.ycombinator.com/item?id=49678250

> if you cant trust the device to do that then no messaging app could ever be secure enough

This is the whole point. Signal actively prevents me from using it outside of the Apple-Google duopoly. Other messaging apps are not like this.

De-jure it's against the ToS, but it's not being enforced besides "don't be an asshole, don't abuse the network and be careful with Signal branding". Technically, you can use Whisperfish on SailfishOS, Flare on mobile-linux-of-the-day or even signal-cli as a primary device.

I don't believe that they will use this against me. But I do believe in the right to use devices without backdoors for everyone, so I support something else instead.

You can achieve the best security without compromises by not using any technology.

It's just an additional argument.

https://matrix.org is used by public agents of France's central administration, Germany's national healthcare system, Germany's armed forces, the Swedish Social Insurance Agency and more: https://en.wikipedia.org/wiki/Matrix_messaging

Qubes can be used together with Heads and a hardware key to verify the boot integrity. Works for me. This is more than good enough for most users, unless you think that your device can be captured while being on by a state adversary I guess. Also it doesn't remove control from the user unlike with GrapheneOS.

The answer from Matrix is here: https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom...

Related thread: https://news.ycombinator.com/item?id=21936929

See also: https://news.ycombinator.com/item?id=35141223

> Most of the data cannot be synced like this.

Isn't it because of lack of the root access?

You could say that.

The lack of root is only significant because unlike in other vendors the built-in backup doesn't work reliably, and you can't use third party software.

But I'm very hopeful, recently they released this Messages update, they're working on introducing native RCS somehow (no idea how but I wish them well), and they recently made a first-class automated call recording.