GrapheneOS currently has around half a million users but the userbase is rapidly growing. The pace of growth will increase once Motorola flagships officially support it. It will increase far faster once lower end Motorola devices meet our requirements for updates and security features so we can expand to those too. Becoming an increasingly mainstream OS is the best way to address the narrative that using it is suspicious, but that's already nearly entirely fearmongering.

On Pixels, GrapheneOS isn't the stock OS and therefore the devices show a notice each boot with the fingerprint of the non-stock verified boot key. This is a standard security feature on the hardware and something we require to be implemented. Verified boot itself is extremely useful for protecting against both physical attacks such as data extraction and also persistence for remote attacks. The verified boot notice provides a way to verify GrapheneOS is genuine without trusting the computer used to install it. The verified boot key is stored in the secure element along with the OS version for downgrade protection. It's enforced automatically so it's not as if people need to manually check the fingerprint each boot, but it does have value in protecting against tampering despite this. It's a feature we want to have on our own hardware too, although GrapheneOS can eventually be considered the stock OS without the verified boot notice.

GrapheneOS is also clearly installed on the SSD. Every block of the data partition is encrypted on storage but the firmware and OS images are public knowledge and verified through verified boot rather than being encrypted. Putting another boot stage before the OS in order to encrypt the publicly available OS images wouldn't achieve anything since that would identify it as being GrapheneOS itself. The only way to hide the OS would be if the hardware itself had a firmware-based passphrase prompt and the first boot stage of the installed OS was encrypted along with the verified boot key in the secure element being wiped when unlocking. It would be possible to provide, but that would be specialized hardware and therefore it could be identified based on the hardware instead of the software.

The stock Pixel OS isn't designed to be able to be installed alongside other operating systems. It assumes it's the only OS and handles updating both the firmware and itself via the A/B slots. It would be entirely possible to have a main OS in those A/B slots responsible for updating the SoC firmware and acting as a bootloader for other operating systems. That would clearly be there on the SSD if that's looked at and would show the verified boot notice every boot.