You always have to temporarily unlock your bootloader to install graphene.

The key point is being able to lock it again after installation.