&gt; How many people are qualified to &quot;verify there&#x27;s no backdoor to your CPU&quot;? Certainly not your average user.<p>I meant there are no backdoors in firmware. Some poor phrasing on my part, sorry. Backdoors in CPUs are obviously a completely different issue altogether.<p>&gt; Allowing Secure Boot to be bypassed is a backdoor in itself.<p>You can have open source implementation of Secure Boot as a Coreboot payload. One such implementation is Tiano Core (UEFI).<p>&gt; Allowing the end-user to modify the firmware at all also allows malicious actors to do the same.<p>Modifying firmware to flash Coreboot usually involves at least switching jumpers or actually physically flashing the memory chip.<p>But even if there’s no hardware switch you are still free to implement whatever security you like in the firmware. Because <i>you control</i> the firmware. So if you want to have signed payloads that’s just fine!