Fedora considers deprecating legacy BIOS

If you are buying hardware from the FBI (or generally if the actual, no shit, manufacturer of the hw is attacking you) you are completely screwed, even remote attestation won't save you (because it'll attest it is unmodified from what you bought!).

I don't really see what this has to do with removing BIOS, sure, you can do hardware attacks. Even secure boot can't prevent these attacks without robust attestation support, or extreme levels of tivoization. You _definately_ can't if you don't even bother to sign the initrd.

I think many modern systems will verify firmware code before allowing it to be flashed, even code that implements the legacy BIOS interfaces (ofc with physical access and enough sophistication you can just replace whatever is doing that verification or storing those keys, though sometimes this ends up being the entire processor).

In any event without an acute awareness of these kinds of attacks and a whole bunch of supporting infrastructure I don't think most systems will be able to prevent this, as it involves some significant useability (and freedom) tradeoffs to protect against an attack model that is uncommon (and if that model applies to you then you had better be well aware of that fact, otherwise you've already lost).