Why can't you upload your own private key in the new bios payload, like you can for SecureBoot?
Everything is sitting in a flash chip. Some parts may be RO, but it can be replaced by another chip if you can't tweak it directly with flashrom.
Vendors burn a key into the system which prevents loading an unsigned BIOS. This is a one-time-programmable fuse (OTP fuse) and part of Intel BootGuard protections.
You get a laptop with _fused burned_ to prevent loading other firmware to your device. Booting won't work if you load a replacement SPI chip with anything but a vendor-signed firmware.