Doesn't secure boot help with this? Unless you believe that the DHS has somehow convinced Intel (etc.) to break the TPM in some way that is quickly exploitable at the border and that nobody has noticed.