I think I must be missing something fundamental. As far as I can tell, the core notion is to move all laptop firmware to an external storage device that has a write-protect switch.

How is this better than an external write-protect switch for the firmware on the device itself? Considering my normal patterns of device usage, I'm just going to put the laptop-specific Trusted Stick into each of my laptops and leave it there. In which case I'm not seeing why it should be removable at all.

And regardless, I'm not seeing how a write-protect switch for firmware, whether on a stick or in the device, is actually better for the average user. At some point the computer is going to tell them, "Hey, you need to allow this security upgrade." How do they know when to allow writes?