Is it possible to have multiple valid mastheads for the same server? I’d like to package a client for a (large) specific group so that the client starts out locked. It seems the most natural way to do this is via the masthead’s “Initial Action Lock” setting, but I don’t want every client to start out that way.
So, is this even possible? If possible, is it a really bad idea? 
You could certainly do that using a custom installer with a clientsettings.cfg to start it out locked. I don’t know about separate mastheads for sure, but find it unlikely.
Alternatively you could start all clients locked, with a Policy Action to unlock all clients except this group.
Testing the clientsettings.cfg option now. Would that be: __LockState=True?
(Answering my own question: __LockState=true appears to work fine, on Windows, anyway.)