Frankly, that's overkill. It's wasted effort.Encryption is enough, who cares if some ninja re-flashes my machine with some fake Libreboot, that would maybe record my passphrase or something?
It's extremely unlikely such a scenario can happen.
Plus, if we're talking about workstations, if the said ninja has access to the computer, it's faster and easier to switch the CPU for his. So hardening the access to re-flashing is even more pointless to me.
