The ideal security mechanism would provide us with a per cpu key from Intel, which we use to update our own user key to the cpu, and only user signed firmware is loaded.
The exact mechanism of this can be handled in many ways.
Right now, we locked out, and primed for being snooped on without our consent.
I like Intel's engineering, but everything else I could do without.
And ARM is no better. I'd say worse actually, but I'm not going to defend that.
Please, please, AMD do the "right thing" with Zen. Allow us to be in command of our security, so we may delegate it to those we trust with the technical know how, be it OS vendors, or our IT departments, or our own selves.