Intel claim one reason that you just have to trust their binary blob PI/FSP to do these kinds of things is because at each stepping release of a given CPU there

Intel claim one reason that you just have to trust their binary blob PI/FSP to do these kinds of things is because at each stepping release of a given CPU there are different early boot errata and microcode abilities until microcode is loaded from flash. It's a bit of a stretch, but the insulation can be thought of as useful in the right light.