> And of course the CPU (whether you pick Intel or AMD) is full of blobs, management engine, etc.

It's buried, but their website claims the ME is disabled by default: Go to "Configure", expand "Firmware", and click "Learn More":

> By default, the Intel ME is disabled on both coreboot and AMI.