BlackRing

GrapheneOS supports recent Pixels. I think right now they are supporting the 5a and later, with legacy and extended support back to the 4.

I use Hostpoint.

They were recommended by Protonmail, and meet my privacy concerns.

I like this a lot. I would add, in case it’s not obvious, to be ready to assert control once they are on the defensive. Otherwise, it becomes a situation of the pigs beating you with experience fighting in the mud.