Options:

• Just start it from the terminal with torsocks
• Use application-specific proxy settings
• Since torsocks simply uses LD_PRELOAD, you could try to make this apply globally by adding the torsocks library to ld.so.preload. Just put the path returned by torsocks show in /etc/ld.so.preload.

Either use the --proxy option of yt-dlp, or use torsocks to transparently torify any application.

Try perhaps the solution in https://unix.stackexchange.com/questions/648084/docker-interface-tears-down-wifi-internet

Try removing all the superfluous default routes.

Argon2id (cryptsetup default) and Argon2i PBKDFs are not supported (GRUB bug #59409), only PBKDF2 is.

There is this patch, although I have not tested it myself. There is always cryptsetup luksAddKey --pbkdf pbkdf2.

GRUB works just fine with LUKS2 these days. There is no need to switch bootloaders.

This seems right and exactly the way I’ve set it up. On subvolid=5 I have subvolumes @ and @home, in /etc/fstab I mount / as subvol=@, and /home as subvol=@home.

Could you run sudo lshw -C network and post the output for the wireless interface?

But you can do this.

Memory safety would be the main advantage.