Comment by Schweigerose

That still requires you to have an OS installed that can not be trusted.

And who maintains and "runs" that hypervisor?