basically LOs wants to get close to something that is highly secure, right now we can't run net banking apps and more apps that need selinux as enforcing, bootloader locked, non rooted and extra extra. LOs will disable root by default, enforcing is mandatory for official builds, and the private key changes makes sure that the integrity of the ROM is well defined to run those apps. We are moving to completely compatible thing