Youness Alaoui wrote:
avoid any malware writing to the flash
Just disallow flash writes by the platform. Allow flash writes only by dedicated hardware (maybe ChromeEC?) which implements a simple and efficient security protocol.
Looking for a software solution is IMO like Intel trying to secure SMM.
//Peter