This [1] is a great read about the chain of trust, it boils down to whether you can trust your UEFI, if you can trust your UEFI, then you can trust your OS and

This [1] is a great read about the chain of trust, it boils down to whether you can trust your UEFI, if you can trust your UEFI, then you can trust your OS and its trusted public keys and the chain doesn't break. From the essay > Now, no one has actually observed UEFI being compromised, nor has anyone captured any UEFI-compromising Trickbot code. The thinking goes that Trickbot only downloads the UEFI code when it finds a vulnerable system. > Running in UEFI would make Trickbot largely undetectable and undeletable. Even wiping and restoring the OS wouldn't do it. Remember, TPMs are designed to be unpatchable and tamper-resistant. The physical hardware is designed to break forever if you try to swap it out. [1] https://pluralistic.net/2020/12/05/trusting-trust/#thompsons-devil https://pluralistic.net/2020/12/05/trusting-trust/#thompsons...