To successfully defend the BIOS from malicious rootkit installation or other malware that writes itself inside BIOS I wonder if these ideas are possible or even done yet:
Can you program the BIOS itself in a way that it only accepts data to be written to the BIOS that has been signed with the BIOS-Manufacture's PGP-Key? Basically the same way like normal userland programs get their updates installed.
Is it possible to encrypt the whole BIOS data to prevent attackers from just 'upgrading' your BIOS with their malicious code?
In both ways it would be sufficient to protect the BIOS only from write-to-BIOS access. While reading from BIOS doesnt require authorization.
Edit: Is there any way to implement this on your own? Like you secure your HHD with Bitlocker or verify a peer with public key cryptography.