so... just sell a phone with a script prompts the user to install the OS, and it auto-verifies hashes, can't be bypassed, etc. Is that too simplistic a solution?