[cat-dev-null]

Your questions seem to conflate two things: nonrepudiation (which includes integrity) of firmware and A3E for I/O.

- Treat firmware like a file, save hashes of them in a public-key signed baseline db. Basically hash everything that can be dumped and throw alerts if anything in the targeted policy changes. (Tripwire for firmware)

- Thinking about it again, v2: end-to-end encryption is needed from driver/app through to device silicon. Key management might require "pairing" would be an initial secret provided separately (like the security model of an Entropy Key, but perhaps not a burned-in secret). Given that most actual drivers are proprietary anyhow, consider today's drivers as http:// when https:// everywhere is needed to defend against bus-sniffing.

http://www.entropykey.co.uk/