[raxxorraxor]

It is still the correct solution. A sensible default doesn't conflict here, but hardware switched are the only solution where you can be entirely sure.

[kube-system]

The problem is a separate switch leaves mainstream non-paranoid users unprotected, because it requires conscious activation by the user.

And anyway, a lid switch is a hardware switch. But most importantly, it activates passively during normal usage patterns.