Excitingly, the talented coreboot folks have found a way of disabling much of Intel's Management Engine: https://www.coreboot.org/pipermail/coreboot/2016-September/082038.html