GrapheneOS

Pixel-only and unapologetic about it, because tying itself to verified-boot hardware is exactly how it gets to make stronger guarantees than rivals that chase device breadth. That’s the trade: you buy into Google’s phone hardware to escape Google’s software, and a sandboxed Play layer keeps real apps working. For a high but practical threat model it’s the most credible mobile OS going. Skip it only if you refuse to own a Pixel.