But how to actually enable registry lock, at Verisign level for .com domains? Verisign's page about this doesn't explain how to actually do it.

Have you ever done it?