If security is the primary concern over everything else, why not make an iso image using all the parts of the filesystem that you want to be read-only - slap it on a cd and mount a few hdd partitions off of it for areas you need to write to. rootkit that! It only costs a pound/dollar/whatever each time you want to make some changes to the read-only parts. johno