[DHowett]

There are machines that keep track of chassis intrusion and measure it into a PCR, making the hardware replacement part of the attack less feasible; I’ll grant that your “evil maid” could also pass off a completely separate device as being yours, though.

FYI: The tone of your original question suggests that you might have prepared responses to any answers you might receive about secure boot and kernel lockdown. If that’s the case, maybe a comment tree isn’t the correct forum for having a discussion about it because of the inherent information inequity.