I know the question is rather broad because I am not specifying which hardware and which OS, but that is intentional. I know there should be a root of trust verification in hardware (ROM) before the image is trusted and installed. But are there are any other restrictions? I mean, does the presence of another peripheral/hardware change the scenario?
No. Secure boot is intended of providing a chain of trust for the software path. So for example, if you boot a CD, the secure boot will verify the CD is signed.
But if you boot from a harddrive, theres no need to check if the CD is "trusted" because the CD contents is not involved in the boot process.
When the BIOS has handed over the booting process to the signed first stage bootloader (MBR) on the harddrive, its the first stage bootloader's responsibility to verify the second stage loader, that its signed. And so on, the second stage will then verify kernels and boot drivers are signed, and when main OS boot up, the main OS will then verify other components.
If added hardware causes the computer to select another boot path, for example a added PCIe drive or similiar, and this boot path contains data that fail signature validation, of course secure boot will fail.
Added hardware such as keyboard or such, kan be prevented by setting up policies in main OS. Since no key input is accepted until the main OS is started anyways, the computer will be secure. The only exception is the BIOS prompt, but that can be protected with a password.