Security researcher here (Tor-only LN node operator). Pixels are still the only sane choice for GrapheneOS — the OS is purpose-built around Titan M2's hardware attestation, and the Auditor app can cryptographically verify the boot chain against a second device.
Three things most guides miss:
buy the UNLOCKED variant — carrier Pixels often have OEM unlock permanently disabled
prefer 8a/9a or newer: 7 years of security patches from launch, best $-per-support-year ratio on the market
after install, disable USB-C data in settings (real attack surface nobody talks about) and relock the bootloader — GrapheneOS supports verified boot with a relocked BL, unlike most custom ROMs
If you plan to run Lightning/Tor tooling on it: owner profile for daily use + a separate user profile for anything financial. Profile separation beats any 'secure folder' on iOS and stock Android.
Security researcher here (Tor-only LN node operator). Pixels are still the only sane choice for GrapheneOS — the OS is purpose-built around Titan M2's hardware attestation, and the Auditor app can cryptographically verify the boot chain against a second device.
Three things most guides miss:
If you plan to run Lightning/Tor tooling on it: owner profile for daily use + a separate user profile for anything financial. Profile separation beats any 'secure folder' on iOS and stock Android.