Sidenote: Intel does that first stage before PCI/LPC root init using a bootrom on the CPU which also contains the hash of the RSA public key required to be used

Sidenote: Intel does that first stage before PCI/LPC root init using a bootrom on the CPU which also contains the hash of the RSA public key required to be used on the signed firmware it loads next. The enforcement policy on that depends on BootGuard fusing and the CSME/SPS.