DoH & DoT still leak the domain name (and of course IP address) you’re connecting to. The domain name leak can be solved by Encrypted Client Hello but that’s still a draft and not turned on for many servers.

I’dv deleted the default, it’s never come back.

Used it for the last few years. X just doesn’t work right with multiple monitors of different resolution.

You wouldn’t end up at a login screen, you’d end up in the last logged in user’s session.

CPU doesn’t have any secure storage, so it can’t encrypt or authenticate comms to the TPM. The on-CPU fTPMs are the solution, the CPU then has the secure storage.