> Personally, I wish there was an open/libre device on the market that GrapheneOS could target.

You mean, Pinephone and Librem 5?

Let's start with HW secure element and boot chain verification (IMHO the minimum bar that's met by e.g. a 2013 Thinkpad), then work thru the rest of GrapheneOS' checklist.

Also: Android. If I didn't need Android/iOS apps, I'd be using a Nokia 3210.