[tptacek]

The point is that it doesn't matter what the typical person will do. All that matters is that somebody, somewhere reverse engineers the EFI binaries, and that it's easy enough for normal people to run a program to check their current EFI against a whitelist of known good EFI binaries.

This is a banal point, except: if the threat is that Intel (or some other huge vendor) backdoors their EFI binaries, it will get out that they did so. It's not "the perfect crime"; it's practically the opposite of that: one guaranteed to be detected, and that will exact maximal damage on the perpetrators when it gets out.