When purchasing a Librem laptop, you have presented with several options for boot firmware (“BIOS”):
Plain coreboot, with SeaBIOS as boot loader.
Preconfigured PureBoot: Librem Key with factory-generated GPG key set, the Librem Vault USB drive is used to store public GPG key.
For what is PureBoot, please read through entire PureBoot FAQ category. You can also see it in action.
The same as above, but the key is shipped separately from the device. This means that a malicious person cannot have your laptop and your Librem Key at the same time, thus leveling up protection.
The same as above, but with additional measures to make any tampering attempts during transit obvious. We will initiate a secure line of communication with the customer (via encrypted email or chatroom) in order to arrange this. Note that this option may delay shipping of your laptop for a few days. See anti-interdiction services announcement for more info.