If it's to be really secure, how about an RSA public/private key pair? Public key gets burned on the mobo, private key comes on a flash memory you store securel

If it's to be really secure, how about an RSA public/private key pair? Public key gets burned on the mobo, private key comes on a flash memory you store securely. BIOS has an option "disable secure mode" or whatever that requires you to physically insert a flash drive with the private key on it.