With lock, YOU are the one coordinating. After a machine gets added it can't do anything until YOU sign a lock message. (I.e. sign its pubkey and publish that)