Secure Boot can (and typically does) operate without a TPM, so no separate hardware module. However, flash writing can be limited in hardware, so it would be p

Secure Boot can (and typically does) operate without a TPM, so no separate hardware module. However, flash writing can be limited in hardware, so it would be possible to store Secure Boot keys in a special region of the flash that's locked down right after the opportunity to get to that setup screen passed.