No doubt about it.  If your main board is supported by one, your'e much better off replacing it.

Thanks, great resources, I did only know of purism so far. I will look into it. I've made no distinction between Secure Boot and Measured Boot so far.
But by now it's obvious to me that an open source firmware is a key requirement.

You need a laptop with the Intel Management Engine (IME) disabled.  The following vendors can help:

Next you need to pick a setup that has a USB key to verify that your bootloader wasn't modified (Measured Boot).  This will require PIN entry to load your OS after every upgrade.

And for a final layer of protection, if you're comfortable with linux, consider Qubes!

bitcoin

How to know if laptop has been tampered with?

^^ exactly

You need a laptop with the Intel Management Engine (IME) disabled.  The following vendors can help:

* https://minifree.org/
* https://puri.sm/
* https://starlabs.systems
* https://shop.nitrokey.com/shop

Next you need to pick a setup that has a USB key to verify that your bootloader wasn't modified (Measured Boot).  This will require PIN entry to load your OS after every upgrade.


And for a final layer of protection, if you're comfortable with linux, consider Qubes!