It needs to run from FLASH and not an EFI partition. <br />It needs to run at startup before the boot loader and OS. <br />This is in order to make it non-removable and unskippable, unlike apps in /EFI/BOOT.<br />I am aware of the other options you've mentioned, I've even done it on a real machine.