add FAQ entry for bootloader locking reminder during device setup

static/faq.html

@@ -92,6 +92,7 @@ <h2><a href="#table-of-contents">Table of contents</a></h2>
                             <li><a href="#ad-blocking">How can I set up system-wide ad-blocking?</a></li>
                             <li><a href="#ad-blocking-apps">Are ad-blocking apps supported?</a></li>
                             <li><a href="#baseband-isolation">Is the baseband isolated?</a></li>
+                            <li><a href="#bootloader-locking-setup">Why am I seeing a message about my bootloader not being locked when setting up the device?</a></li>
                         </ul>
                     </li>
                     <li>
@@ -1466,6 +1467,35 @@ <h3><a href="#baseband-isolation">Is the baseband isolated?</a></h3>
                     is problematic and a HardMAC implementation with most complexity in the isolated
                     firmware could be better than the status quo. An isolated driver would be ideal.</p>
                 </article>
+
+                <article id="bootloader-locking-setup">
+                    <h2><a href="#bootloader-locking-setup">Why am I seeing a message about my bootloader not being locked when setting up the device?</a></h2>
+
+                    <p>If you are seeing this warning when setting up your device after GrapheneOS
+                    has been installed, it means that not all of the installation steps have been
+                    completed. This can be remediated by finishing the installation process and
+                    locking the device's bootloader.</p>
+
+                    <p>To do this, follow these steps:</p>
+
+                        <ol>
+                            <li>Navigate to the bootloader locking section of the <a href="https://grapheneos.org/install/web">web install
+                            (recommended)</a> or <a href="https://grapheneos.org/install/cli">CLI install</a>
+                            guide on the device you'll be using to lock the bootloader.</li>
+                            <li>If you are at the welcome screen on your GrapheneOS device, tap "Next".</li>
+                            <li>On the resulting screen, tap "Reboot to bootloader".</li>
+                            <li>Connect your GrapheneOS device to the device where you have the install page open.</li>
+                            <li>Follow the steps on the install page to lock the bootloader.</li>
+                            <li>Once locked, you can start setting up your GrapheneOS device, and the warning should no longer be present.</li>
+                        </ol>
+
+                    <p>It is important to note that this is something that should be done before
+                    placing any data onto the device, as until this step is completed, the device is
+                    considered to be insecure. Please note that locking the bootloader wipes all
+                    user data on the device. GrapheneOS doesn't provide any support to users running
+                    GrapheneOS with an unlocked bootloader, as this is considered to be an
+                    incomplete installation.</p>
+                </article>
             </section>
 
             <section id="day-to-day-use">