With the following patch series, we could successfully boot a locked XO-1 with F11-XO1 with leases.dat stored on a USB stick. We've not yet tested activation over wifi.