137
The security co-processor in many CPUs is insecure
(www.heise.de)
This is a most excellent place for technology news and articles.
For #2, Full Disk Encryption (including bootloader)
These protections work at different layers and hence, you use both.
First off, you can't really encrypt the first boot loader by design, your UEFI needs something it can read and run. You need to protect this first boot stage somehow, and this is what Secure Boot is for; it verifies the signature of the payload it starts to protect it against tampering.