That solution is measured boot, and it exists within Boot Guard: Instead of validating against a fused key, the chipset (not the CPU!) sends a hash of the bootblock to the TPM ('measures the bootblock'), to be stored in a PCR (platform configuration register) that the CPU can't modify.
If you later want to make sure that your system wasn't tampered with, you can do a (remote) attestation step in which you have the TPM try to use a key sealed ('configured to only be readable if PCR(x)=y') to that hash. If the answer isn't satisfactory, something is wrong.
The TPM is a reasonably safe storage for keys, and using its crypto primitives, while slow, prevents replay attacks.
In this configuration, if you choose not to trust the vendor, you can simply clear the TPM, have it generate your own key pair, and use that for attestation.
So, the issue is that Intel, in their infinite wisdom, decided to also give vendors that other option (verified boot) that enables them to shoot their customers in the foot. Similar to how Intel TXT uses an Authenticated Code Module (signed code as initialization dependency, this time Intel only), while AMD's SKINIT also just measures the code into an otherwise inaccessible TPM register, allowing the end user to decide which code to trust.
Intel even provides a proper solution...
If you later want to make sure that your system wasn't tampered with, you can do a (remote) attestation step in which you have the TPM try to use a key sealed ('configured to only be readable if PCR(x)=y') to that hash. If the answer isn't satisfactory, something is wrong.
The TPM is a reasonably safe storage for keys, and using its crypto primitives, while slow, prevents replay attacks.
In this configuration, if you choose not to trust the vendor, you can simply clear the TPM, have it generate your own key pair, and use that for attestation.
So, the issue is that Intel, in their infinite wisdom, decided to also give vendors that other option (verified boot) that enables them to shoot their customers in the foot.
Similar to how Intel TXT uses an Authenticated Code Module (signed code as initialization dependency, this time Intel only), while AMD's SKINIT also just measures the code into an otherwise inaccessible TPM register, allowing the end user to decide which code to trust.