Some devices allow you sign your own images and relock the bootloader [0]. This allows you to modify your image, sign it, flash it and relock your bootloader.

Some devices allow you sign your own images and relock the bootloader [0]. This allows you to modify your image, sign it, flash it and relock your bootloader. If you have the infrastructure in place, future updates could be rolled out as OTA updates for your custom rom. You'll still fail hardware attestation and afaik whatever api that returns the boot status differentiates between a vendor signed and a custom signed image. So not perfect, but you lose the bootloader unlocked nag. [0] https://android.googlesource.com/platform/external/avb/+/pie-release/README.md#Device-Specific-Notes https://android.googlesource.com/platform/external/avb/+/pie...