It is much easier to mandate a way to run code on modern systems, in the "SMM" style, upon seeing a cryptographic signature which the NSA holds the key across the memory bus. About 20 people in each of Intel, AMD, nVidia, Qualcomm, Apple need to know about it (well paid and NSLd to shut up; perhaps even NSA employees embedded in these companies and the companies themselves none the wiser), about 3000 transistors which would be lost in today's many-billion transistor CPUs. It doesn't have to be fast, and not even perfectly reliable - it just needs to work.

In fact, I'll be astonished if in the future it turns out that such a thing is not already implemented today. Do you really thing the NSA doesn't yet have a copy of Intel's microcode signing keys?