It would be nice if you can make an hardened, privacy-security oriented version of Sparky in the future for users who need extra privacy and security features.
The first thing for increased security for the individual user would be to not use the rolling - testing version of the Debian base. Sid-Unstable and Stable (Debian) get the security fixes first, often approximately the same time. Rolling - testing would be 5 days later at best. As stated previous, I am just a hobbyist.