The Mac uses secure enclosures along lines that many others do, and there are workarounds that allow full decryption, while at the same time preventing you from actually setting up private spaces via the undisclosed hardware and evolution of the variant of ME they happen to be using.
Signal is not private by default. You have to know exactly what you are doing.
Many of the other recommendations are untested, with no consensus.