I think full disk encryption with a plaintext keyfile in the boot partition is a good minimum.

To erase the drive; securely delete the key and all copies.