Why? There are other equally open source os's I can just run instead, that don't require me to excuse or verify anything?

Even if there were something special about graphene that made it more desirable, the real way to deal with an open source project with something unacceptable about it's production or management, is to fork it. But I already have something else to do all day, and am happy to run lineage or calyx or or others. If I did need a fork, I'd need someone else to do it, and I'd have to trust them.

Fork it or help someone else who is forking it or work towards changing the original (which is what seems to have happened actually, so this is all a bit academic now), or just use anything else, are all more reasonable responses than "the people producing this thing with access to all my communications have shown themselves to be off the rails, so what I'll do is keep using it, but personally read all the code in an entire android os."

The point is, you don't have to trust Micay about a darn thing. The code is open. That's the whole point. Dismissing open source software because you don't trust the developer is absurd.

Saying that you don't have to trust anyone because the code is open is absurd.

If Micay says, "The code does X," anyone who can read it can review it and say, "No it doesn't. It does Y." It's right there. You don't have to trust him. He's shown it to you.

It doesn't matter what the code actually is, or that you can see it, you still have to trust people because there is simply too much of it, even if you happen to be a coder, which 99% of people should not be required to be. This is a FUCKING MORONIC thing to have to spell out, but I guess here we are.