The Intel ME subsystem can take over your machine, can't be audited
I would use thunderbolt as it has DMA, create a CRC/F(x) cpu (external unit connected thru thunderbolt) that converts/encrypt code/data to a expected format by modified code generated by a compiler.
making act the intel cpu as surrogate to it, delegating control to the CRC/F(x) cpu.Extra points, make all the cpus work, and create extra tasks to run at the non used cpus to obscure the actual process running (yeah I know it's not energy efficient but someones has to give Intel inspiration to improve).