As I mentioned, Intel BootGuard has firmware keys burned into the CPU so that only firmware signed by Intel can be used as a bootloader. This is done to avoid b

As I mentioned, Intel BootGuard has firmware keys burned into the CPU so that only firmware signed by Intel can be used as a bootloader. This is done to avoid boot-kits, but results in users not being able to flash their own firmware on their devices (so CoreBoot cannot be used on OEM machines with newer Intel CPUs). Note that enclaves can be used for things other than HSMs, and could be used in far deeper parts of the stack than just as a HSM interface.