I've been looking into this and here is what I have tried so far:
- Flash TWRP viennaltexx via Odin (fails, with auth error)
- Flash TWRP viennaltexx dd directly to partition (flashes, but will not boot with SECURE FAIL)
- Attempt to modify TWRP with kernel from original recovery, and initrd from TWRP (fail, same as above)
- Flashing the stock image via dd directory to partition (works, so check is in boot not flashing)
What I have not tried yet:
- Attempt to replace bootloader (aboot) with non-locked bootloader from non-verizon viennaltexx model
- Find more info about Qualcomm SecureBoot to attempt to self sign or otherwise bypass security.
So I am guessing the image itself is signed and not just the kernel. If anyone has more info on Qualcomm SecureBoot it may help.