Use brew to update the core Unix utils such as bash, tar, sed, etc to the latest GNU releases. The mac has really outdated BSD-based versions.
colournoun
It sounds like the SSL/TLS version or allowed cipher list are configured for higher security on your machine or browser and the sites that are failing are using a lower security config. I’m not sure where that config is on Arch. Try a different browser. Also try fetching the sites with curl just to see if that works. Curl’s verbose mode will also tell you what ciphers it tried.
curl -v https://example.com/
A quick fix might be to disable any ipv6 addresses if you don’t specifically need them. The vpn /could/ be ipv4 only, which /could/ leave your ipv6 free to leak or make ipv6 dns requests.
Agreed. Theoretically possible, but practically not possible unless you are an embedded hardware engineer with access to Sony’s datasheets and potentially crypto keys. Some sort of external box is much more practical.
assfish are soft and flabby
Agreed. Windows updates will very likely break your single-drive dual-boot at some point. So, use two different drives and use your bios/efi to choose which one to boot.
Edit: check out https://hackaday.com/2021/11/30/linux-fu-the-ultimate-dual-boot-laptop/
Edit 2: Framework 16 looks like it would meet your needs. It has two M.2 sockets for drives. https://frame.work/products/laptop16-diy-amd-7040
Go to their shows. Buy their merch. That’s where the creators get the most profit.
800TB of bandwidth per month?
If you’re not already, use it as your main system. Don’t dual boot. Stop using windows and mac. When you run into something you need to do, figure out how to do it on linux. It will be slow going at first, but after a few months you will pick up more productivity than you had before.
Another commenter recommended the fish shell, but I disagree because fish is not posix compliant. Almost all of the shell script examples that you will find assume posix compatibility and will usually have to be modified to run with fish. Once you get comfortable with a posix-compliant shell, then maybe consider fish or another “modern” shell.
On the topic of shells, read the bash manual. It’s long and informative. You don’t have to memorize it, but be aware of the different concepts there, and refer to it when you need to. It’s pretty horrible as a programming language, but it’s what glues most of Linux together.
First, make sure it’s enabled in your kernel. Check the value in /proc/sys/kernel/sysrq to see if it’s enabled. Then see if you can trigger it by writing to /proc/sysrq-trigger. Then try an external keyboard that has real SysRq key. If all of those work, you may have to ask Framework support if their keyboard supports generating that keystroke.

The key enrollment that Mint did sounds like registering the Machine Owner Key (MOK). That basically tells the bios that anything signed with that key should be permitted. The MOK is especially required when compiling your own drivers. Anything shipped by a Linux distro should already be signed so that the shim will permit it. SecureBoot is more about making sure your boot files haven’t been tampered with rather than being about preventing the owner from doing something.
You should already be able to boot any modern Linux OS that has support for SecureBoot. Only if you compile your own drivers or kernel would you need to use a MOK. If you do need that, you should be able to enroll another MOK or copy the MOK key files from the Mint install and use those keys to sign drivers in any other Linux distro.
The cli program
mokutilwill let you view and export your enrolled MOKs.