One thing that bothers me is the seeming lack of transparency about who is running GrapheneOS. Daniel Micay supposedly stepped down, so who is calling the shots now? Who runs the CI? Who owns the update servers and signing keys? Who am I trusting?
+1 This complete lack of transparency is the same gripe I have with the Signal Foundation.
FWIW, https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&cor... lists three directors for the GrapheneOS Foundation: Khalykbek Yelshibekov, Daniel Micay, and Dmytro Mukhomor.
Daniel Micay is still running the project despite announcing he'd step down a while ago. You can see the entire team on their Github
What I find particularity odd is that on their donation page [1], Daniel Micay's personal Github account is linked as a donation option (using Github sponsors).
(I opted to donate via bank transfer instead, because that is at least addressed at the GrapheneOS Foundation, not one specific member.)
[1] https://grapheneos.org/donate