Fedora considers deprecating legacy BIOS

> If you are buying hardware from the FBI (or generally if the actual, no shit, manufacturer of the hw is attacking you) you are completely screwed, even remote attestation won't save you (because it'll attest it is unmodified from what you bought!).

Not entirely. If you're on Intel and Boot Guard is enabled, the firmware will be measured before it's executed. If you're specifically targeted with modified firmware (even if it's signed appropriately), then those measurements will be different and there'll be reasons to ask questions. Of course, if the vendor just ships backdoored firmware to everyone, that doesn't help (but it does increase the probability that someone will notice the backdoor) - and if Intel is in on it, then obviously all bets are off.