For various reasons Kicksecure tries to diverge by the smallest possible amount from its upstream projects, and especially from Debian:
- wants to share its work with the rest of the Free Software community;
- benefits from additional code review;
- values maintainability very much and believes users are best served if Kicksecure keeps the amount of work needed to maintain Kicksecure as small as possible;
- Dev/maintainability;
- Focus on low-effort maintainability
Note: Whonix is Based on Kicksecure.
For quantum-resistant cryptography, Kicksecure and Whonix ship with the Codecrypt package by default. Note that, as post-quantum algorithms have been frequently broken by cryptanalysis, using Codecrypt alone is potentially a bad idea. It would likely be better to encrypt data with GPG first, then encrypt the GPG blob with Codecrypt, ensuring that if either kind of encryption is broken, the other one still has a chance of working.