I'm about to publish an update to it that uses a toolbar popup to fill out forms instead of the current lag approach, which will also protect against keyboard layout leaks[1] (which Tor browser/privacy.resistFingerprinting protects against anyway)
> Don't use mixers and tumblers, use Monero and/or Monero atomic swaps.
Monero doesn’t make your transactions anonymous, it makes them ambiguous. your wallet might default to using an n=6 ring signature, meaning it picks 5 random addresses with balances and creates a transaction that could have plausibly originated from any of those 5 or your own. so you get plausible deniability, but also if your threat actor can unmask the other 5 addresses (which might not be so hard if those accounts are regularly interacting with exchanges) then you’re done.
zcash gets you actual transaction-level anonymity, not just ambiguity. fewer places accept it, but in theory you can still break the link by obtaining zcash and then exchanging it for the currency of your choice on any exchange that doesn’t ask for PII (e.g. a DEX)
Whonix uses Kloak to mitigate this [1], but unfortunately it isn't available in Qubes-Whonix.
> Mixers and tumblers will eventually leak
Don't use mixers and tumblers, use Monero and/or Monero atomic swaps.
But, you are right that it is futile to maintain defense against a determined 3 letter agency.
[1]: https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak