Yes, presuming physical access as well as access to the signing key, an attacker could certainly deploy malicious microcode. It would be a very scary thing inde

Yes, presuming physical access as well as access to the signing key, an attacker could certainly deploy malicious microcode. It would be a very scary thing indeed. It seems a reasonable threat model if your adversary is a malicious state actor, or similarly well funded and ambitious organization. Edit: I assume this threat has existed as long as updatable microcode has.