Of course the firmware could hash itself. The question is what value is there in trusting and untrusted component to tell you it's trustworthy.