I wonder if there'll be any transparency around the database of known 'good' firmwares? For example, could a state actor force inclusion of a 'bad' firmware in the list? That's rhetorical, but the question is wouldn't it be better if end users could have visibility into the list of valid hashes? A count of the prevelance of each hash would pretty quickly highlight any with only a handful of appearances in the wild.