AFAIK Knox would trip a fuse if you installed custom firmware and would prevent you from using banking apps and the like permanently but you were still able to flash the firmware.