Link between device state & user settable root of trust
Custom root of trust has to be set from fastboot according to docs. The OEM can implement it in different ways, the docs recommend that a custom certificate can only be installed from UNLOCKED state
Once your certificate is installed as root of trust, you can boot in LOCKED mode (only binaries signed by either you or the OEM will be allowed to boot)
Following the docs, a warning should be displayed if booting a custom signed firmware (booting the OEM signed one shouldn't ?)