I've come to the conclusion that this is the only reasonable technical solution.

Don't travel with sensitive data, and openly explain that you don't do so.

The frustrating part is the UX, and the fuss when you land.

I've found that this works:

- Burner android (burner account explicitly for travel) for music, podcasts, light browsing, etc.

- Cheap ThinkPad for headscratching / hacking (work over SSH, keys on a Yubikey, IP in your head. YubiKey as second factor for password manager as browser extension (uninstall before the border))