I tend to just operate on the principle of: I know my setup probably wouldn’t hold up for a second if some sort of organized three-letter government body decided to focus on me, but my threat model is more the kind of general internet-sweeping surveillance fuckery that goes on. I’m not doing anything especially dodgy on the internet and I think messing around with privacy stuff is fun, so my security level is faintly absurd for what it is. I’m sure someone could crack it if they were determined enough, but I assume the amount of effort required relative to what you’d find would just make it pointless anyway.