[Nexus 5X Q&A, Help & Troubleshooting] gee one:
Note: This is for informational purposes only. These changes have significant security implications, which could also lock you out of your device. I am intentionally not posting the patches because there are enough bricked phones out there already. These changes will also affect how and what you are able to flash- including bootloader, radio, and vendor updates. Essentially, you will have to resign anything you want to flash with a whole file signature.

Yes, it is working well. I usually build from source and tend to just stick with CM, so this works for me. The CM recovery also doesn't have a backup/restore option for data. If you tend to flash different roms or rely on the backup/restore functions in TWRP, then these changes might not be suitable for your use-case.

There are a few things that need to happen for this to work. Most of these changes happen in the build system so that they are applied automatically. I suppose you could apply some of them manually to an official zip and just sign them afterwards, although making the changes to the system and recovery zips is probably just as complex as making the changes to the build system, so you might as well do it once.

1) turn on verity in fstab.bullhead for user debug - this will check the verity signature of the system partition at boot time.

device/lge/bullhead/fstab-verity.bullhead
diff fstab.bullhead fstab-verity.bullhead
6c6
< /dev/block/platform/soc.0/f9824900.sdhci/by-name/system /system ext4 ro,barrier=1 wait
---
> /dev/block/platform/soc.0/f9824900.sdhci/by-name/system /system ext4 ro,barrier=1 wait,verify=/dev/block/platform/soc.0/f9824900.sdhci/by-name/metadata

2) disable the backup script in the OTA. There is a backuptool flag in core/Makefile. Setting this to false will prevent the backup script from running. When you flash a CM rom, it will automatically mount system and backup any gapps files, as well as a few others. When the system is mounted, it will change some of the metadata, which will break the verity signature. By disabling the backups script, it will keep the metadata intact. The "downside" to this is that everything you want to flash has to be built into the rom. I include pico gapps in my build, as well as /etc/hosts for ad blocking.

3) update signing keys and verity. There is a script to update the signing keys in development/tools/make_key The signing keys are located in build/target/product/security. There is also a cm-devkey and cm certificate that will get included in the build. If you want extra fancy security, you should probably remove these. I haven' t tested removing the cm certificates extensively, so do this at your own risk.

4) I also updated the adb keys so that my computers are recognized automatically. The adb keys go in system/core/rootdir. The adb script has a keygen option to create new keys. You still have to enable adb in the development settings. Be sure to back up your adb keys since if you change them or delete them, you won't have shell access in the cm recovery.

5) I add in pico gapps and etc/hosts so that I don't have to flash them in recovery, which would break the verity signatures. etc/hosts is included in a similar fashion as the adb keys. I added gapps in vendor/gapps/bullhead similar to the way proprietary files are added. I just wrote a script that unpacks opengapps and adds in the additional makefiles.