It's not a "loud threat", and it's only if you keep the stock coreboot. With a debug cable, you can flash anything you want, I have a fully custom coreboot+edk2 build with cleaned ME and no signature checks anywhere.