You can re-lock the bootloader with your own signing key on Pixels. GrapheneOS seems to be the only third party ROM currently taking advantage of it.
But it requires you to set up your own build + signing server in AWS.
I haven't tried it, but I believe part of the reason that AWS is recommended is due to the build time.