I think your observations are pretty much spot-on, except for your last point:<p>&gt; The stick being external doesn&#x27;t seem to provide much advantage otherwise, since if the laptop hardware is malicious it doesn&#x27;t help, and if it is not malicious then an internal trusted stick equivalent works just as well.<p>I think it provides a security-conscious user an added level of comfort&#x2F;faith over a built-in solution.  If you move the flash memory out to this external unit, and there is simply a three wire type of interface that pretty much only gives the system no permanent writability to the flash contents, that is a fairly solid and tangible promise.  To some degree, you get to assert a new level of control over the &quot;root of trust,&quot; at least the poinbt at which it begins in firmware.<p>That doesn&#x27;t mean that there is not room for motherboard vendors to improve things, but we will have to have faith in them having done things correctly.  I am not even talking about a hostile motherboard vendor - there are plenty of good faith or half baked efforts that end up being circumventable.