Purism is working with coreboot to provide laptops where you can verify the integrity of firmware on your device, within the limits of Intel CPUs.
https://www.tomshardware.com/news/purism-heads-rootkit-tampe...
"Purism announced that, after almost a year of testing, it was able to successfully integrate the Heads firmware into its TPM-enabled and Coreboot-running Librem laptops. The open source firmware, which checks if someone has tampered with the laptops, allows users to freely inspect and customize the code. Purism also recently announced that all of its new Librem 13 and 15 laptops now include a TPM by default, so they all come with the Heads firmware by default, too."
Previously: Google on "Replacing exploit-ridden firmware with a Linux kernel", https://news.ycombinator.com/item?id=15579592