Some more searching seems to lead back to where I started: the microcode itself isn't phoning home, the only phoning "home" that occurs is the normal process of "when you pull down an update for something, it requires phoning to the repository holding the updates".
The implication the comment I was replying to gave was that the device sent unexpected network traffic back to Intel HQ, with the connotation that it was doing so to leak information about my system.
So normally only the build servers contact Intel. Source-based distributions may. But even then the source files are verified with cryptographic hashes (which are in turn signed by the maintainers' private keys).
Edit: I may have misread your question. I thought you were asking by implication if the microcode blob is pulled after the install. If not, then: No. Updates happen when the package manager decides.
https://www.kernel.org/doc/Documentation/x86/early-microcode...
https://gitlab.com/iucode-tool/iucode-tool
https://downloadcenter.intel.com/download/26400/Linux-Proces...
It has only been six days since it has become possible to neutralize the ME firmware for Sandy Bridge and Ivy Bridge[1].
It is like a Matryoshka doll sitting inside the Intel CPU of your computer. Therefore, yes, it can contain all of that. For further details see my other two posts.
1. https://en.wikipedia.org/wiki/Intel_Active_Management_Techno...
So yes, it's a standard. I believe there was also a standard on how to tie a noose for hanging a human, but that didn't mean much to the one getting hanged.
Intel's microcode updates are cryptographically signed; the CPU will not accept an update without Intel's signature. The format is not publicly documented, but independent research [1] suggests that it's 2048-bit RSA.
Intel needs to allow 3rd parties to build a small piece of hardware for private key storage, generation, signing and encryption, with self-distruction upon tampering. Then customers need to be able to go to the store, pick which vendor they want, and they plug it into their motherboard. By selling them in the store when the customer can make a surprise purchase, then that prevents tampering upon shipping withe ecommerce deliverables.