There's a reason security-conscious roms like GrapheneOS and CalyxOS only support devices where the bootloader can be relocked after installing.