Build yourself, using your own signing keys and your own patches (if you need any - I do).

There are various Docker images with everything necessary in the Dockerfile and user needs to only specify the device's model name (and any extra options, like build type).

Takes some time but the only thing one needs to trust is the source code (which is nearly impossible to fully audit, though)

It has auto-updates built in, not sure about where they're hosted, though. Still probably more trustworthy (and up to date) than the stock OnePlus Android builds that my phone includes by default (OP3).