On Google Pixel devices you can load your own verified boot key into the "avb_custom_key" partition and then it will only boot OSes signed by it (it will also s

On Google Pixel devices you can load your own verified boot key into the "avb_custom_key" partition and then it will only boot OSes signed by it (it will also say that you are running a different operating system in the boot screen). GrapheneOS for instance uses this mechanism. Unfortunately you can only register one key and you have to wipe the device to change it, but that's still fine for most use cases.