Earlier quoted context omitted.
There's Lineage OS
Do you still have to download their builds on shady servers?
There are various Docker images with everything necessary in the Dockerfile and user needs to only specify the device's model name (and any extra options, like build type).
Takes some time but the only thing one needs to trust is the source code (which is nearly impossible to fully audit, though)