That’s about the only way I see out of this, yeah. No fuses blown is obviously a specific state (works as expected everywhere). All-fuses blown needs to be a specific state too (say the trustroot is dead and it’s now “just a cpu”).

You couldn’t just fail to that state (it’d be inappropriate for its primary use-case), as long as there’s some way to get there.