only host FW can get bootstrap credential. credential is generated on each request and it gets deleted on system reset.
OS or option rom can also get bootstrap credential. So, BMC can identify it is BIOS by checking the boot progress code. (OpenBMC has boot progress code implemented)
Boot progress support is a requirement from ARM SBMR specification:
Idea: Bootstrap credential + ComputerSystem.BootProgress