Agreed there is a point where one has to instill trust in some entity. That said, cpu microcode is miles away from trust the blob that initializes the system hardware. You can get a secured boot for your kernel, but aside from that there isn't much guaranteed.

As for my original question: your biggest concern with chromebooks is the high barrier for replacing keys so that self-signed kernels can be used?