Everything running like a Swiss watch after latest nuke & pave. Most likely attack vector? A dodgy repo! Never add & trust random strangers security key! Home repos are excluded by default, which I will definitely steer clear as once the key is trusted is there really anyway to verify what is installed?
On a side note the X250 was the last X Series ThinkPad with old style logo (BBC anyone?) which I hugely prefer, also the fingerprint works reliably under openSUSE. Not like the X260’s encrypted effort.