I would like to add some constructive conversation instead of banter about the cert...how does this get around malware/rootkit software that is embedded in the

I would like to add some constructive conversation instead of banter about the cert...how does this get around malware/rootkit software that is embedded in the mobo or bios. How is this really any different than a LiveCD of Kali Linux or something? I see that it is read-only media so I suppose that helps, but in the end its still only as secure as the machine that you run it from.