A few more random items that have been mentioned in other discussions or popped into my mind
- Signed installers & ISOs
- Post-Quantum crypto support/ enforcement
- SELinux/LMS support & challenges
- Secure Boot
- Adoption of core libraries written in memory safe languages (OpenSSL discussion)
- systemd unit hardening
- Secure (Authenticated) NTP
- DNS over TLS/HTTPS/ODoH
- Default application sandboxing (e.g. Browser/ email client)