Well the idea of having attestation isn’t the problem. The problem is that apps requiring attestation (banks, insurance providers, ID-systems) use the most convenient solution. Slapping on Googles prebuild attestation. Graphene for example, provides alternative attestation for their OS and offers docs for anyone to implement a more fitting set of checks.

There are two approaches here: If you’re upset that your hacked-to-bits, rooted, unlocked and/or unencrypted device is failing checks: I’d say, tough luck. Until we can create provably untampered app-containers, that level of access genuinely breaks TOS on apps and regulations on handling personal data. Breaking those checks is then breaking those compliances in an unsafe way.

If you believe your setup is actually secure and compliant, just not in a way the allmighty Google intended: Try and get an attestation module for your setup. Fight for these apps to accept non-Google attestation and fight for devices that don’t artificially limit what can pass as secure.

I feel there are plenty of local activist/independent servers all over the EU. As long as you mind the encryption/anonymization, you can even round-robin them. Having a central EU authority is better than Google/Cloudflare and should be safe, if the implementation is sound. But there is a lot of room to meddle.

By LeOS? Any GSI-Treble enabled Android phone. So most any phone with an unlockable bootloader. You can use the treble info app to check or search online.

https://gitlab.com/TrebleInfo/TrebleInfo/

LeOS isn’t very popular, because it’s a passion-project by one guy, with little marketing. Said guy is a somewhat opinionated Woodstock-era hippie, hence the colorful icons (they can be easily swapped via an icon-pack of your choice.) Though he is a friendly person.

To my knowledge it’s the only Treble-option with a hard stance on de-googling. Specifically made as an answer to some policies in eOS. There is an interview with him floating about, if you want the backstory. https://nixfaq.org/2021/01/exclusive-interview-with-guntram-lead-developer-of-a-popular-custom-degoogled-android-rom-called-leos.html

Hey there, for starters A-GPS, stun, secure DNS, and several other preconfigured servers default to Google. Some of these can be changed with ADB. Check out a guide on de-googleing LineageOS for a more complete list. It’s not AOSP, but close enough. There are also Google servers configured in the sources. How valuable those connections are, depends on your threat-model. If you’d like a paranoid GSI, check out LeOS. It’s probably the most complete treble-compatible option. AOSP by default, isn’t very private.

And have a script to secure erase the key material. Much faster and will prevent forced/coerced unlocks.

An advantage of Tuta and Proton is, that there is a basic free tier. Your Mail is a center-point of your online activity. Hoping it to never happen, if you ever can’t afford the (cheap) price, you won’t lose access to your mail. Which would suck, for all accounts linked to it.