You can do almost as well by finding a piece of software with a code execution exploit early in boot that’s signed by the bank. A different model would be to o

You can do almost as well by finding a piece of software with a code execution exploit early in boot that’s signed by the bank. A different model would be to only allow a given EFI binary to be booted if it was installed before the deadline, but that might well have a different set of complications.