If the NSA are targeting your systems they will use a backdoor'd version of Coreboot.

And in this case the malware is lurking in the RAID cards expansion ROM, so you wouldn't even notice a change at boot anyway.