I'd stick to having a unified vfat boot+EFI partition mounted at /boot. systemd-boot is the simplest bootloader and it doesn't support loading it's config and kernels from non-vfat partitions anyway. Just make a 5GB boot+EFI partition so you can store plenty of kernels or even a recovery image.

For security, I recommend following Madaidan's Insecurities Linux hardening guide, it has good explanations of most of the same sysctl options and kernel flags. [1]

The only option that may be best left disabled is `init_on_free=0` since this is one of the few options that has a measurable performance impact (besides the normal spectre/meltdown related options).

For NTP, systemd-timesyncd works fine and is probably the default for any modern distro.

Desktop security is still a nightmare, if you use a Wayland based desktop environment and Pipewire for audio/video streams then maybe in 10 years you'll a secure clipboard and no unauthorized keyloggers.

[1] https://madaidans-insecurities.github.io/guides/linux-harden...