For power-users: Are all third-party ROMs blocked?

No. We currently support GrapheneOS when the bootloader is locked. We may support other third-party ROMs if:

• They do not break the AOSP security model,
• They support installation with a locked bootloader,
• They properly configure and publish self-signed verified boot keys for their ROM, and
• They promptly update to the latest AOSP patch level. We frequently update minimum operating system security requirements.

If ROMs do not consistently adhere to the standards above, we will remove them from the set of supported verified boot keys.

A lot of ifs, but I guess it’s a beginning?