But an adversary could easily use a bad usb when they have physical access to the computer and glitter nail polish doesn’t detect that. I guess that this is why nail polish isn’t sufficient on its own and why we need also either trenchboor or Heads.

it would be interesting to know how much does usbguard protect against this. of course you also need to do something to limit booting from usb, but how effective is usbguard in practice?
what is the risk of sticks that tries to compromise the machine through kernel driver vulnerabilities?
is it possible that it compromises some other firmware on the machine (like the EC in laptops)?
or that it takes advantage of some hardware design failure?

Personally I’ve only heard about Heads so far, but I think this is an interesting topic. Could you give us a short explanation about why is SRTM not enough, and what is a better way?