Oh, good point. I guess it depends on your usecase. I was thinking from the angle of not trusting premade network cards but trusting your USB chips.... which now that you point out, is also not a given. Maybe bare serial (just a wire per tx/rx), but it suddenly occurs to me that I don't know how that's actually connected to the CPU, and I think that approaching this from a security angle is a quick road to madness. OTOH... connecting a microcontroller to serial probably is the simplest option and as an engineering exercise is perfectly reasonable, if not exactly fast, but hey it's not like this was ever going to be performant.

> Maybe bare serial (just a wire per tx/rx), but it suddenly occurs to me that I don't know how that's actually connected to the CPU

In practice today, if you have a DB9 serial port, that goes into the section of the chipset which is concerned with all the "legacy" interfaces, which ultimately turns up on the PCIe bus like everything else.

> I think that approaching this from a security angle is a quick road to madness

Yes.

USB LS/FS are pretty implementable in select FPGAs and MCUs without a dedicated PHY.

Ironically, USB SS is more implementable than USB HS without a dedicated PHY. USB SS's PHY is just standard CML differential signaling used for almost all modern high-speed protocols like PCIe or SATA (but with an LFPS extension for link negotiation), most FPGAs already have built-in support for it. Meanwhile USB HS's PHY is a completely non-standard one: it's LVDS-like but the signals are not fully differential, it's half-duplex and needs bus arbitration, etc - only USB HS PHYs speak this odd language.