Why do you think buying a used device might
make trust even less? Do you really trust the vendor/shipper?
And why should we trust on Gluglug, for example? This is irrational,
since x60/T60 is out of production. Also, we shouldn't "trust" it, we
should -know- this is working correctly.
You can verify on your own, as it's free software.
The MacBook Air comes with a keyboard/trackpoint controller that can
easily transformed into a keylogger (as many other devices, too).
Every supported libreboot laptop have this same problem, they all
have blobs on Embedded Controller.
I think the correct point here is ask if libreboot supported laptops run
microcode. Acording to GNUtool here [1] the x60 still running microcode
even removing it on bios.
That's one of the main issues with coreboot and the intend of Libreboot
in general. Please see the 'goals' section on Libreboot.org [1]. The aim
is to provide a modified coreboot version without all the blobs (and
without cpu microcode updates). As mentioned before, there still might
be something in the silicon which we are not aware of. So in the end we
need Free Hardware Specifications to be 100% sure. From my pov, what
Libreboot offers is the best we have atm.
smime.p7s