Why not just have the wifi-controller hardware already there, but strip out the software required to make it do anything? I.e. modularize the BIOS firmware suc

Why not just have the wifi-controller hardware already there, but strip out the software required to make it do anything? I.e. modularize the BIOS firmware such that you flash "the BIOS firmware" and "the wifi/bluetooth stack firmware" separately, to separate chips. Then ship the motherboard without the wifi/bluetooth stack firmware pre-flashed — with the NAND that the wifi controller initializes from, just empty, such that the wifi controller immediately halts on boot, and the CPU doesn't find it on the bus. Make sure the rest of the BIOS works without the wifi controller "up". And then have an open root key of trust for the BIOS (= you can sign your own BIOS), but a closed root key of trust for the wifi controller (= only the OEM can sign the wifi/bluetooth stack firmware.) It doesn't seem like it would be all that hard, given that we already have this kind of hardware firmware (+ firmware storage) modularity in modern devices in other ways — e.g. most trackpads have their own isolated firmware, that the host can flash to update, but which isn't otherwise accessed by the host CPU, rather only the trackpad microcontroller itself; where the trackpad firmware flash lives inside the trackpad, not in the host.