[romaniv]

The hash can be computed in hardware or via ROM program.

[tryp]

Of course the firmware could hash itself. The question is what value is there in trusting and untrusted component to tell you it's trustworthy.