Apps4Flip-AdminLevel 5 - Gold Elite Member
When a device powers on, the bootloader first checks if a device is LOCKED or UNLOCKED. If a device is UNLOCKED, the bootloader shows the user a warning and then proceeds to boot even if the loaded OS isn't signed by the root of trust.
If the device is LOCKED, the bootloader goes through the steps in Verifying Boot to verify the device's software. LOCKED devices boot only if the loaded OS is properly signed by the root of trust. For more details, see The boot flow.