If you have an Intel CPU, there is a good chance you have a KVM built-in (whether you wanted one or not): Intel AMT. Its reputation was tarnished by Intel's dissimulation and opacity about the technology, and a streak of critical vulnerabilities disclosed in late 2017. I chose to take my chances with it anyway for my homelab server. It is secured with a password, mutual TLS (client has to provide a cert), and restricted to the LAN via a physical firewall. It gives me serial console, KVM, and power control.
I like it. It works pretty well. I don't see a reason to trust it any less than closed-hardware, closed-source solutions. I would trust a fully-open-source PIKVM more, however.
The tooling and documentation for setting up Intel AMT via open-source tools is meagre, so I had to roll my own. I only need a small nudge to package it for others to re-use, so reply to this post if you are interested.
I've had a number of thinkpads and nucs with vpro/amt. All the things you say are technically correct, in practice the software and feature set are horribly documented. I've spent numerous hours trying to get it to work reliably only to find out something is too old or not supported or just disabled.
I like it. It works pretty well. I don't see a reason to trust it any less than closed-hardware, closed-source solutions. I would trust a fully-open-source PIKVM more, however.
The tooling and documentation for setting up Intel AMT via open-source tools is meagre, so I had to roll my own. I only need a small nudge to package it for others to re-use, so reply to this post if you are interested.