It's not optimal because your have to go thru Android anyway and since Android phone end up having a very limited lifetime of updates you will have to run a chroot on top of an unsecure/obsolete Android version over the long run.
Build yourself, using your own signing keys and your own patches (if you need any - I do).
There are various Docker images with everything necessary in the Dockerfile and user needs to only specify the device's model name (and any extra options, like build type).
Takes some time but the only thing one needs to trust is the source code (which is nearly impossible to fully audit, though)
It has auto-updates built in, not sure about where they're hosted, though. Still probably more trustworthy (and up to date) than the stock OnePlus Android builds that my phone includes by default (OP3).
