Comment by Retr0id

If you make a bootloader unlock require a full wipe/rekey of the device, and make unlock status visible at boot, most of the "someone might unlock my bootloader maliciously" concerns go away.