To use with a modified Linux kernel that emulates a bog standard Thinkpad uefi environment of course.
EDIT: I forgot to phrase this as a question - besides missing a QubesOS or KickSecure on top, is this a decent plan for airgapped stuff?
UEFI can be emulated on top of BIOS using something like Clover. But for your BIOS-only mobo, just keep using it with a BIOS-only bootloader, ie GPT disk with grub or whatever written to the MBR + BIOS Boot partition. There's no reason to involve any UEFI, emulated or otherwise.
You will obviously not have as good protection from evil maid attacks as you would've gotten from Secure Boot. But presumably you're okay with that, and emulated UEFI will not help in that regard anyway.
I didn't say it did. In fact I formulated what I wrote precisely to convey the opposite message.
>they can replace the currently active UEFI bootloader with a shim app, enroll their own key.
UEFI can be protected by a password if the implementation supports it. How secure that is is of course up to the implementation.