I am (still) trying to understand exactly how verified boot works and I am wondering what happens when a user-settable root of trust is used by the device. As said here:
If the device is LOCKED, the bootloader goes through the steps in Verifying Boot to verify the device's software. LOCKED devices boot only if the loaded OS is properly signed by the root of trust. For more details, see The boot flow.
- Does the fact of setting a user-settable root of trust imply that the device has to be UNLOCKED?
- Does it mean that a LOCKED device can boot on a custom OS if it is signed with the user-settable root of trust?
- Is the warning still displayed if the user-settable root of trust is used to validate tue boot process?