With Heads, the firmware measures itself and sends the results to the TPM. If an attacker flashes a modified firmware that simply lies about the measurement results, the entire security system will be bypassed.

This is not true:

https://forum.qubes-os.org/t/discussion-on-purism/2627/187

https://forum.qubes-os.org/t/discussion-on-purism/2627/177

that's still secure boot, isn't it? just not uefi but homegrown?

fine with me. I read GP as rejecting the whole idea.

to point at another elephant in the room: at some point I came to realize that the ME is a x468 running some BSD. that little bitch has full access to your machine.

if trust and security is the objective, we're in for a hard ride to find trustworthy hardware.

ME is disabled and neutralized on my Librem 15: https://puri.sm/learn/intel-me/