http://blogs.coreboot.org/blog/2015/02/23/the-truth-about-pu...
Which is much less than they market it, but that's part of the issue some people in the coreboot community have with Purism. They present it as some groundbreaking success (while it's nothing but clicking a different checkbox in a tool), and I really doubt it's the "first [laptop] to ship" that way. Chromebooks come to mind.
Boot Guard is a hardware-level protection that cannot be removed or disabled.
Of course the latter is (theoretically) non-malicious, but something of that permanence disturbs me far more than some easily-removed malware. The fact that it is used to ensure that the OS and everything above it is in an "assured state" means that it could also be used to prevent users from uninstalling "approved" software like Superfish.
How would Lenovo react if Broadwell devices began receiving many service calls under warranty? Presumably the lock could be changed by a motherboard replacement.
Related article, http://www.pcworld.com/article/2883903/how-intel-and-pc-make..., ".. New thinkpad's can't be used anymore for coreboot. Especially the U and Y Intel CPU Series. They come with Intel Boot Guard and you are won't be able to boot anything which is unsigned and not approved by OEM. This means the OEM are fusing SHA256 public key hashes into the southbridge.
... to their credit, Intel does allow PC manufacturers to configure the hardware in a different way. The real way to get that open hardware seems to be to build it from scratch and make the right decisions along the way, as Purism is trying to do. If you want this sort of open hardware, be prepared to vote with your wallet."
Purism: https://www.crowdsupply.com/purism/librem-laptop