What I would try and convince the people of who you are working with is that security is a continuum running from almost totally secure to almost completely insecure (to the extent that there is such a thing), so in reality pretty much no OS will be completely secure. What is interesting, I think, is that usability is inversely related to security. If you imagine that an OS which wouldn't allow you to write to the disk and wouldn't allow you on the internet you can imagine that when security is that high you'll get almost no usability.
with that in mind I would advocate trading a lot of usability for security - you could have an encrypted disk and run a terminal with something like nano and lynx installed - this would be pretty damn secure especially if you were running it on fairly secure hardware (did Intel ever fix the security issue that theo de raat was talking about in the Core 2s?) with something like OpenBSD as the core. This, I think would allow you (after some modifications) to allow pretty robust security. A downside though is that I'm pretty sure you might be compelled to run in English as I'm not sure how good the language support is for this sort of thing (with no GUI I can't imagine it would be great). Even so, I think if your data security is important (and lets face it, in this situation it probably is) then the trade-off might be worth while.
Of course, perhaps the more gaping hole in security is the user themselves, who could always reveal all the information they had to anyone... XKCD said it better - http://xkcd.com/538/