The things that make it difficult to do this are only obstacles to adversaries that don't have access to Intel's secret keys. If you have those, by design you can both bypass secure boot and reflash the BIOS with whatever code you like, and the very same restrictions that stop normal users from doing those things also make it impossible for them to detect that it's happened. The NSA has an entire well-funded division dedicated to helping enable eavesdropping by retrieving information like those keys.

Those security features are genuinely only useful for stopping people from installing Linux and open BIOSes. They can only protect computers from their users, not from the NSA.

Exactly. Lavabit example is 100% clear: one user is enough for three letter agencies to get the court request for all the private keys.

The only way trusted computing secures your computer is if you install a TPM chip with your own certificate and constantly verify that it is active. If it runs software signed by Microsoft or Apple, it's useless against a state agent.

Presuming, of course, that the TPM wasn't backdoored (or even just had keys held in escrow where the NSA could reach them), which would be more or less impossible to verify.

Yeah, I'm sure that 'trusted computing' isn't effectively the Clipper Chip by another name.

Remember one simple fact: with all such schemes, the end user is the one party involved who isn't trusted.