The original cold boot paper was released in 2008 and they only demonstrated the attack on DDR2 memory [1]. A paper published in 2013 [2] discussed cold boot on modern hardware.
"This study is based on 5 different computer
systems. While we demonstrate that simple warm
reset attacks (not cutting power) are effective even
against DDR3 systems, we were
not
able to detect
any data remanence for DDR3 after cold boots. Even
cooling the RAM chips did not reveal data remanence
beyond cold boots. This leads us to the claim that
cold boot attacks relying on RAM remanence beyond
cold boots are not possible against modern DDR3
RAM chips."
"For various reasons Tails tries to diverge by the smallest possible amount from its upstream projects, and especially from Debian"
"We try to push our changes upstream when we need to modify software we ship. This often requires us to write code in a generic way, rather than implementing ad-hoc hacks to fit our specific needs: e.g. we often need to make the stuff we need opt-in and add configuration options."
The official term for this is "Debian derivative" rather than "fork."
OpenVPN defaults to tunneling over UDP, but optionally supports TCP. SSH is always over TCP. Here's a bit of info from the man page [1] for anyone who's curious:
" OpenVPN is designed to operate optimally over UDP, but TCP capability is provided for situations where UDP cannot be used. In comparison with UDP, TCP will usually be somewhat less efficient and less robust when used over unreliable or congested networks."
You can use LVM to make the swap partition inside the encrypted container. If you don't want to use LVM, you can just use a swap file on an encrypted partition (but this isn't supported with btrfs).
Speed isn't the only consideration. If you're using disk encryption, the only way to remove keys from RAM is to power off or hibernate. Preserving state between sessions with hibernation is much more convenient. Also, Linux only uses RAM * 2/5 as the size of the hibernation image [1]. You can make this even smaller by changing /sys/power/image_size. So with 16GB of RAM, it only has to write/read about 6.4GB.
"This study is based on 5 different computer systems. While we demonstrate that simple warm reset attacks (not cutting power) are effective even against DDR3 systems, we were not able to detect any data remanence for DDR3 after cold boots. Even cooling the RAM chips did not reveal data remanence beyond cold boots. This leads us to the claim that cold boot attacks relying on RAM remanence beyond cold boots are not possible against modern DDR3 RAM chips."
[1] https://www.usenix.org/legacy/event/sec08/tech/full_papers/h...
[2] http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldb... (search for DDR3 to find the relevant sections)