Clearly, you're right. The question is true over almost all computing equipment more advanced than an IBM PC with Floppy Diskette drives. These days even our C

Clearly, you're right. The question is true over almost all computing equipment more advanced than an IBM PC with Floppy Diskette drives. These days even our CPUs are like the VAX 11/780, which had a boot processor of it's own, to load microcode. The only way I can think of being secure is reduce computing to a cartesian grid of 4x4 bit Look Up Tables (LUTS), clocked A/B like a checkerboard. This "bitgrid" as I call it can be worked out by hand on graph paper if necessary, and can make strong security guarantees. It would be slow...but since we're concerned with starting everything else up, that's not a huge deal. You'd have a clock generator, and external serial EPROM, a hardware address counter in charge of loading the loading the initial state of the LUTS... all single step-able for testing and validation. You could then use that hardware to fire everything else up. Of course, if the LUTS were low enough power, you could just compute with the bit-grid.