It's also possible to relock the bootloader on a handful of Motorola and fairphones, at least as part of the Calyx install procedure

Okay, I was not aware of that, so thanks for the information.

In that case, have fun coding up your own bootloader and flashing it onto the device. If you can't trust the bootloader, then you can't trust anything at all from the operating system that sits on top of it, because it could be compromised. If you can't trust a bootloader, then the only thing you can trust is a pen and a piece of paper.

GrapheneOS uses pixels because not even Google employees can break into it.

I'd be more worried about the ROM that runs before the bootloader that you can't inspect, or possible hardware implants if you don't trust the bootloader shipped to you from the vendor.

Ok what is your alternative? Android Verified Boot with a secure hardware keystore like the Google Titan M2 is basically the best thing you can get.

It has very minimal code and its implemented in a robust manner. Unlike UEFI and the desktop implementation of secure boot, it does work well and it has not yet been exploited on pixels. Its way better to have any kind of OS integrity check than none.