Comment by gruez

You still need to rely on the OEM to properly configure the bootloader, not leak the keys, and provide updated vendor blobs.