Since this is a carrier branded device (judging by 406) and it's also PR 1.1.. I believe it's possible to flash PR 1.2 or PR 1.3 global firmware without hacky certification workaround. You also need N9 RepoMirror installed if you want to enable developer mode.