You always have to temporarily unlock your bootloader to install graphene.
The key point is being able to lock it again after installation.