Mullvad did a really good job writing up this blog post. And yet again GrapheneOS to the rescue.