Well, Pixel is still with unlocked bootloader and is the only phone on the market with which you can bake in your own signing keys, lock the bootloader and have an actually secure boot chain controlled by yourself.