Earlier quoted context omitted.
My https://divestos.org project, while not as secure as GrapheneOS, provides lots of security to many older devices.
Interesting project. Thanks for sharing! Any reason why at least some of those patches couldn't be upstreamed to LOS?
I do send occasional patches to Lineage if they are in-scope and am in contact with some of them reasonably frequently.
The big blocker is that their Gerrit instance requires a Google account to login.
Example of a recent fix I emailed them: https://review.lineageos.org/c/LineageOS/android_device_htc_...