Assurance that binary blobs and Intel ME support has been properly removed. It’s possible to do this with Coreboot if you know what you’re doing, but this is an off the shelf configuration.
Old Libreboot is now apparently Canoeboot, same dev but different project name.