For now I prefer to try aptly tool for repo mirroring, it looks very convenient to me.

Why architecture "all" (common for all CPUs, generally just scripts) mentioned on the page:
https://www.debian.org/mirror/size
is not available?

aptly -architectures="all" mirror create devuan-all-ascii https://pkgmaster.devuan.org/merged/  ascii main contrib non-free

Downloading https://pkgmaster.devuan.org/merged/dists/ascii/InRelease...
gpgv: Signature made Wed 21 Oct 2020 07:59:30 PM EDT using RSA key ID 61FC752C
gpgv: Good signature from "Devuan Repository (Amprolla3 on Nemesis) <repository@devuan.org>"
ERROR: unable to fetch mirror: architecture all not available in repo [devuan-all-ascii]: https://pkgmaster.devuan.org/merged/ ascii, use -force-architectures to override

An example of a package:
https://packages.debian.org/buster/all/firehol/download

Btw, Nitrokey HSM2 USB token and a flat SC-HSM2 4K smart card both implement a data channel encryption (between your PC PKCS11 lib and their crypto chip) via BSI TR-03110 protocol also used in some national personal ID cards. May be it just is so called protection from attacks on emanation side channel.

Actually it may be a wired (not wireless as I mentioned earlier) backdoor, IMHO the most probable channel for remote control is an AC power line, a signal can be modulated somehow and some modern devices with a powerful enough MCUs or SoCs for example like modern HDDs can have corresponding modems to phone via AC line in an active mode, not like a relatively safe for us good old passive readonly TEMPEST known earlier.

1. Two very important channels for data leakage often not taken into account are:
1.1 Electromagnetic emanation from all computer buses (like SATA, USB, Ethernet, PS2, VGA, HDMI, etc.)
1.2 Psi operators can read your mind (your current thoughts and may be even memory) distantly, predict some future and try to correct it in their favor.

Though these two channels are not directly related to each other they are often used by some agencies together at the same time.
So you shall never use passwords as they can be intercepted both from computer bus and your head without any visible connection like LAN, etc.
Always try to use keys which are not stored on devices like HDDs or SSDs. For example Nitrokey company states HSM2 is protected from data leakage by emanation channel (but at which grade? a few layers of tin foil?), though there may be other backdoors in Nitrokey of course. Even their crypto algorithms most likely are not strong enough against NSA and may be other agencies too.
May be GNUK (or Nitrokey Start) sometimes can be better in terms of its open source, I do not know unfortunately.

2,3. My computers were attacked by electromagnetic attacks too, it does not matter if Internet is connected or not.

https://web.archive.org/web/20191105180 … ssues/9518

Also a standalone (without Internet and even without LAN connection) relatively old computer (Intel about 2002 model)  which was almost always turned off at my home was reflashed somehow and did not boot into Linux until I reflashed it again back to a stock BIOS from a floppy.

Another standalone computer (AMD about 2010 model) with a modern HGST 6TB HUS drive was controlled remotely and replaced some of video surveillance files into a binary rubish, and it had ZFS, it means HDD most likely has a backdoor for remote wireless control and its Linux drivers have an interface to bypass control into the kernel and may be some userspace.

Raspberry Pis could not even start without large BLOBs for video chip.

The best what I was able to find are AllWinner Cortex A7 and Beagle Bone Black boards.
They are affordable and can work (at least in a text mode) without BLOBs except their small BROM inside their SoC.

IMHO even librebooted X86 is not good as a secure SSH terminal to control other hosts, they can be used only to host something non critical in terms of security.

I do not know anything affordable for a secure trusted terminal better than an old ARM Cortex A7 free from BLOBs and wireless chips with a Nitrokey or may be GNUK for keeping your secret keys there.

Btw, there is an interesting ARM laptop trying to be as free as possible (not Cortex A7 though):

https://web.archive.org/web/20200828204 … _Main_Page
https://www.bunniestudios.com/blog/?cat=28

Very probable that I was poisoned by a significant portion of staphylococcus (diagnosed later by analysis) during training courses for IBM DB2 administration in a "Network Academy" located in a building of their police academy located in Kazan, Russia on October 13, 2008 in their dining-hall, they brought a meal by themselves. During all night in their hotel I experienced continuous almost non uninterruptible meteorism, there is a eye-witness classmate, we had even to open window inspite of almost winter weather, I never used to eat in their dining-hall anymore and got food in supermarkets during the rest of training days.
When we had meeting with other classmates from different cities in the evening they talked about terror from FSB in their cities like fires and pressure, women mentioned very bad quality of doctor service in maternity hospital and how they got even disability after accouchement and could not sue the doctors in a court.
Also I felt myself sick like in a winter like getting a flue virus, gravedo and feeling very weak, it is an indication of an attack on immune system.
Later when I returned to my city large dark-red sometimes almost black pustules appeared on my head and body for many years and a few still now, during many years I experienced significant headaches. Doctors could not find a course when I asked them earlier.
I had to part with my lovely girlfriend in about two years since that DB2 training

And finally in 2017 I was diagnosed a polycythemia.
After I wrote several times about corruption in Russia my body experienced burning pain and vibration, my mother too (she experienced it even today after this post asking me for a tablet of aspirin), several neurologists  led me to a psychiatrists, they did not do anything to help me except harm in their clinic where I even did not get enough air to breath (a body with blood problems requires more oxygen for living) , persistent  constipation problems during a whole month period of being in their clinic when I repeatedly could not get defecation up to five days even visiting toilet room tens of times and it is even not always allowed by personal to travel to that room, btw. And it was very hard to convince them to purchase and give me laxative, without it most likely I would already be dead.   After leaving their clinic all symptoms returned in about two weeks like body burning and vibration.

Later I have found a med by myself to heal myself successfully from vibration and burning, it is neuromedin and human interferon alfa, blood returned to a relatively good condition too, I do not have an insomnia or headaches anymore except days when I do a med injection.

After that I often treat doctors (I visited tens of them before getting to psychiatrists) like charlatans just serving ZOG and agencies to make tortures against targeted individuals, they are almost like fascist in their activity against targeted individuals.

It works something like following:

We talk about different price ranges, ganstalkers often attack people on a low budget just to make them even more financially vulnerable trying to get them on their slavery galleys in their corporations.

And I think it is still not easy to verify there are no backdoors in POWER9. And it is a CPU with speculative execution yet most likely vulnerable to SPECTRE and like it? When we talk about getting some better performance than ARM it may be enough to get a cheap system with Libreboot or at least Coreboot, run KVM or software emulation on it and manage it from a secure ARM device.

IMHO Talos is a good toy for wealthy men who can purchase a few of them just for experiments and trash them if they do not like something without any financial regret. I just purchased many ARMv5 and ARMv7 SoCs just for experiments, it is affordable for me and I still do not know if they solve the problems which I experienced in the past, but it is not a significant loss for my budget if something goes wrong for some of those boards.

As for ARM I would not trust anything more recent than old ARMv7 boards like Orange PI with a wireless chip removed from the board.
Modern ARMs may have large BLOBs in their SoC boot ROM and they can have trojans working in an ARM TrustZone.

To make me more confident in a current ARM hardware a vendor would have to provide an open source code for his BROM which is inside a SoC.
It shall be built reproducible and result to the same verifiable binaries which could be read from BROM. But it still most likely does not prevent them to have some   hidden code running in a TrustZone anyway or even making such verifiable BROM a fake ROM while running another proprietary BLOB hidden from us.

On the other hand there are a plenty of Cortex A7 oranges free from speculative issues which are good for a mini server running under OpenBSD.
Please understand performance does not matter at all when we talk about security, slow ARMv7 for $30-$50 may be much better and stronger in these terms than a modern shiny computer for a few thousands of USD.
Beagle bone black boards are already free from radio chips and their BROM is relatively small which is less in size than RAM of a good old ZXSpectrum, unfortunately it is not Cortex A7, therefore it is good only for a secure client SSH terminal, for a micro server it is better to use Cortex A7.

You can install only light and the most critical services like SSH, Firewall, some proxies, DNS, monitoring, intrusion detection, Jabber, e-mail, etc.  on those mini boards while running more resource demanding applications as KVM guests on other Coreboot hosts behind this secure gateway based on ARMv7 CortexA7 + Nitrokey + OpenBSD. Just allow connections to KVM hosts only from secure OpenBSD ARM host.

I was in about the same situation as you a couple of years ago.

I can indicate you some steps to at least remove their active presence on your machine, after that they still can see anything you do and even read your mind.

1) Get an older hardware like Core2 Duo with good old BIOS (instead of UEFI) and process it with ME_cleaner to remove IntelME, better to libreboot of course if you can get a right hardware.

2) Get somewhere a very old SD card of size like 256Mb and an ancient SD card reader USB1 or USB2, they are free from modern firmware backdoors. Place your bootloader and kernel onto this SD card.
Always boot your system from USB SD reader, this prevents injecting trojans during boot phase by storage devices.

3) Encrypt all your HDDs to partially isolate from their firmware trojans.
All file systems shall be created above LUKSed block devices.
Use the shortest SATA cables you can get, 10-15cm are the best, it will make it harder to kill data on your disks by active EMI attacks injecting intelligent noise making your HDD working incorrectly for some time.
And try to always use ZFS, it sees all checksums errors when you are under a EMI attack, otherwise you can silently loose your data and files.

4) Use Devuan without systemD, it is an absolute MUST.

5) Do not use modern bloated DE like KDE4 or KDE5, they are full of backdoors and can erase your important ideas in knotes and kalarm at least. I have found TrinityDE is the best DE for a workstation and NoDM+IceWM+matchbox-desktop is the best thing for a server.
With IceWM you can disable almost all services even like dbus, etc.

6) Never run proprietary software like Skype of Chrome on your sensitive computer, have a dedicated different motherboard for them and run them only in a dedicated KVM on it.

7) For SSH access to other hosts keep your secret keys in hardware devices like Nitrokey PRO2 or HSM2.

8) I am going to make an installation of a combi of Devuan+ZFS volume and OpenBSD running from that volume over a dedicated Ethernet link. They will both run on ARM hardware (two separated boards) free from X86 backdoors and trojans. Add Nitrokey PRO2 or HSM2 here and get a relatively good protection at least from general hackers, agencies still can replace your hardware or reflash something (though I guess it is harder to do on a SoC) and they can enter your room not via a front door or a window (don't ask me how).

May be I will share it in the corresponding forum area for ARM builds.

I have found an explanation to some of my questions:
https://wiki.gentoo.org/wiki/Pam_u2f

But still cannot fix issues I  have described above, any ideas please?

https://phabricator.whonix.org/T998

May be he does not know that Devuan is almost the same Debian without systemD.