The only sane way is personal security and freedom, where your device is sold to you unlocked or trivially unlockable, with vendor as default trusted party - sure, and you can arm the security to make device obey only your commands, but no one else (including device original vendor), even if you're tricked (malware-shipping wifi hotspots, fake chargers, etc) or lose physical contact with the device.