Sniffing the bus can be defeated by using encrypted comms. It is disabled by Windows for some reason, but it works as designed in other secure boot implementations. I hope :)