Qubes OS should not certify insecure and ancient hardware

[anon39129773]

@apparatus

The only issue with Heads is that attacker with physical access can flash the malicious firmware without Intel Boot Guard. That’s why I mentioned unfused Intel Boot Guard, with it user can enroll their own key and sign the Heads firmware with it so attacker won’t be able to flash malicious firmware.

Ah I see. I am not deeply familiar with the issues around Heads because I do not plan on using it. NovaCustom laptops are currently unfused and the fusing process for Intel BootGuard will be optional with the next firmware update. They also support Heads firmware.