Duncan Laurie simplest would be to accept approval keys on a CSD register read only set SDCARD or on a internal read only SDCARD slot for developer mode booting that avoides the I am insecure. message with huge time out. You want to check if device is in developer mode check for developer mode SDCARD possible.

I would prefer not to have to nuke the internal firmware to run owns since when it comes to disposing of resetting to factory quickly would be a good thing.