Use hardware-based locking.

I use a Corsair Padlock 2

This will protect from a lost or stolen device. If you get sent to Dictatorstan it's not going to stop the national-level security agency but at least it's tamper-evident and it will stop any of the lesser attacks you actually face (curious teenagers, etc). Good for anyone who has to carry "it's worth your job" data as well as secret bank account access codes.

The access code is entered onto the device directly so there is no keylogger vulnerability.