The problem with drive encryption at the mainboard level is that it comes with a free side order of vendor lock-in. Apple is a good example here. You can't eve

The problem with drive encryption at the mainboard level is that it comes with a free side order of vendor lock-in. Apple is a good example here. You can't even touch the internal storage whether you want it encrypted or not, because all access to the onboard storage is gated by their black box security processor. I'd rather just forego the silicon and do it all in software, since there's no way to ensure that the OEMs aren't being bastards. Another reason is that the hardware vendor is in a great, centralized position to be backdoored either by hackers or the bad guys with badges.