jdkfree

They have e2e on all devices now.

If you can get transit to release data in a standard protocol, then I think that'd be fine. I would just be afraid of closed devices needing access to closed protocols and APIs. There be dragons.

Maybe something like nixOS where the phone's state is the result of a pure derivation. No installing or configuring anything except through a privileged ssh after decryption. Then boot and go again.

Only automatically updating is possible from the device proper, rollback on failure.