The Pixel devices do this well. If it doesn't trust the OS the bootloader shows a big scary warning. If the OS is signed by Google then it boots up without the warning.
So when you got your second hand device you just need to check the bootloader while booting. If it warns then you need to flash a stock iamge.