Review Bootguard section stating only librems come with unfused keys, refer to vendors page, refer to leaked MSI bootguard private key

[tlaurion]

From https://osresearch.net/Keys/#management-engine-and-bootguard-acm-fuses :

The x230 Thinkpads do not support bootguard and only the Librem laptops ship with unfused keys.

This is not true anymore and for a little while with NovaCustom buying Clevo in bulk with unfused bootguard, see reviewed https://osresearch.net/Vendors/

[tlaurion]

Also point to this community effort https://github.com/felixsinger/bootguard-status

[tlaurion]

This key is stored in the on-die ROM of the ME and the ME will not start up if this signature does not match. An
attacker who controls this key (highly unlikely) can subvert the Bootguard checks and the measured boot process.

Not unlikely, refer to MSI bootguard key leak

[tlaurion]

This key is stored in the on-die ROM of the ME and the ME will not start up if this signature does not match. An
attacker who controls this key (highly unlikely) can subvert the Bootguard checks and the measured boot process.

Not unlikely, refer to MSI bootguard key leak

https://sizeof.cat/post/leak-intel-private-keys-msi-firmware/