Restoring all but Custom Rom to stock?

I have an A5chl model 816 flashed with a nightly CM12
build. Its also rooted.

What I'd like to do is unroot, restore the stock recovery,
relock the bootloader and keep CM12 for the up to date security
patches.

I tried relocking the bootloader once and was locked into
only being able to boot into the bootloader (Was thankful to
find out relocking a previously unlocked loader doesn't
initiate any wipes!).

Is there any way to do this? Security-wise it seems the
best possible setup outside of someone owning a
Nexus device which has the latest fixes stock.

I read of a hack for HTC M8 devices which allow
relocking and unlocking the bootloader and reseting
the tampered flags, etc via adb shell commands.

I still have S-On, but something like this for the 816 would
be very welcome.

With all the Android security loopholes, going back to Stock seems
somehow less secure to me, even with a locked
bootloader.

Anyone?