Link between device state & user settable root of trust I am (still) trying to understand exactly how verified boot works and I am wondering what happens when a user-settable root of trust is used by the device.
As said here:


  If the device is LOCKED, the bootloader goes through the steps in
  Verifying Boot to verify the device's software. LOCKED devices boot
  only if the loaded OS is properly signed by the root of trust. For
  more details, see The boot flow.



Does the fact of setting a user-settable root of trust imply that
the device has to be UNLOCKED?
Does it mean that a LOCKED device can
boot on a custom OS if it is signed with the user-settable root of
trust?
Is the warning still displayed if the user-settable root of
trust is used to validate tue boot process?
Custom root of trust has to be set from fastboot according to docs. The OEM can implement it in different ways, the docs recommend that a custom certificate can only be installed from UNLOCKED state
Once your certificate is installed as root of trust, you can boot in LOCKED mode (only binaries signed by either you or the OEM will be allowed to boot)
Following the docs, a warning should be displayed if booting a custom signed firmware (booting the OEM signed one shouldn't ?)