Ideally, at least for headless server hardware, if you have physical access, you could wipe the provisioning key and replace it with your own. Doing so should

Ideally, at least for headless server hardware, if you have physical access, you could wipe the provisioning key and replace it with your own. Doing so should blow away the disk keys, etc. I’ve always assumed systems that relied on a key and didn’t support that were backdoored.