Belated response here (and certainly not trying to talk you into Oxide!), but just for anyone who happens upon this, we do solve exactly the problem you describ

Belated response here (and certainly not trying to talk you into Oxide!), but just for anyone who happens upon this, we do solve exactly the problem you describe. We have a true root-of-trust[0], a proper service processor in lieu of the larded-up BMC[1], an isolated management network[2] -- and we don't have a BIOS at all[3][4]. [0] https://oxide.computer/blog/exploiting-undocumented-hardware-blocks-in-the-lpc55s69 https://oxide.computer/blog/exploiting-undocumented-hardware... [1] https://oxide.computer/blog/hubris-and-humility https://oxide.computer/blog/hubris-and-humility [2] https://rfd.shared.oxide.computer/rfd/0250 https://rfd.shared.oxide.computer/rfd/0250 [3] https://rfd.shared.oxide.computer/rfd/0241 https://rfd.shared.oxide.computer/rfd/0241 [4] https://www.youtube.com/watch?v=cWDDx74s090 https://www.youtube.com/watch?v=cWDDx74s090