It's called "defense in depth". A signed, attestable boot path is how you get defense in depth against malware attacks. Period. All computing is headed this way.