GrapheneOS if you can live without Google Wallet and hardened Google Pixel (the only secure Android device family to date).