@Suiseiseki read-only SPI flash can't get security updates
grub verifying a kernel doesn't matter when there's nothing verifying grub, that's the point of secure boot
if you're secure-boot signing your own bootloader, the signing key is on the machine, which defeats the point
the entire chain of trust falls apart when it doesn't start from secure digitally-signed firmware, which avoiding is the entire point of libreboot