For high assurance applications I strongly advocate for hashtag#openbsd whenever possible.

That’s because it can be trusted to do nothing on its own.