Found a partial answer. The FAQs confirm that with coreboot, you can dual boot from the SD card.
So I guess my remaining question is how Heads and the Librem Key work if you swap cards with different operating systems installed on them. What I ultimately want is just to know that the bios hasn’t been altered. I could live with not knowing if the boot partition had been altered. Is that doable in this scenario?