I think the most useful way to answer this question is to start with the hardest part of the answer and work my way down
should have as much open-source firmware or security certifications as possible.
As such my starting point would be the coreboot page, since that lists systems which support opensource firmware
I'm picking thinkpads here. I'm familiar with them, and the removable parts are mostly trivial.On this list, the T60 look handy. many of these features are found on newer thinkpads, but its worth considering some of the modern, boneheaded moves lenovo has made. The newer ones have worse keyboards, and of course, you need to find a superfish free version. Go with intel graphics in any case. Further research shows that "Ministry of Freedom" sells somewhat newer models than my initial recommendation of a T60 preflashed and those are worth a look. That said, the features I like about the T60 are true here too.
Lets go down your list. I have an R60, and its the 'cheap' equivilent of an T60 so I have a decent idea what the features are. Being a thinkpad, thinkwiki has a great rundown on the features.
Yes, its an older machine, but I have them running reliably with minor upgrades. They're really nice machines with a low end SSD.
Must feature a removable battery
Two latches and it pops out
Must feature a (somewhat easily) removable BIOS battery
Requires removal of the keyboard and that's about it. 3-4 screws, and you don't even need a service manual to find it. Bit finicky, and I'd recommend a spudger and a small screwdrive (cross head). There's a video here on the process.
Must feature a removable drive
Its an old school thinkpad. One screw, pop out the cover, yank the drive
Must be able operate without a persistent storage drive
R60's USB bootable. I've done it a few times. Maxing out the ram might be an idea.
Must be able to boot from a CD / DVD either via USB or internally
Yup. Onboard, standard ATAPI drive, boots off USB fine.
Must feature at least three USB type A ports
Yes
Must be able to operate with Linux derivatives
As an older machine, compatibility is solid. I'd be reasonably confident even running a full DE on it, though my machines run windows 10 or xubuntu/lubuntu.
Should have as much open-source firmware or security certifications as possible
Price should be sub 500 USD if possible
Ebay prices are significantly below that. Could even buy spares. I strongly recommend maxing out the ram if possible.
These are solid machines, and despite their age hold up well.
