Sibling comment says this doesn't matter because you can "just" tap the chip. I don't know if that's true, but practically, isn't the real reason why this doesn

Sibling comment says this doesn't matter because you can "just" tap the chip. I don't know if that's true, but practically, isn't the real reason why this doesn't matter is that there are a bunch of signed bootloaders that let you boot untrusted code? For example, famously, the Kaspersky rescue disk. [1] Even assuming that the key for this particular disk has been revoked, trusting this to protect your system seems rather fraught, as it's not good enough for your kernel to be secure from ring-0 privesc, every single signed image in the world needs to be as well. Could be I'm missing something. Is it impossible to replace the boot disk entirely once Secure Boot is enabled? Hard to see how the hardware failure case would be handled. [1] https://habr.com/ru/post/446238/ https://habr.com/ru/post/446238/