Let's start with HW secure element and boot chain verification (IMHO the minimum bar that's met by e.g. a 2013 Thinkpad), then work thru the rest of GrapheneOS' checklist.

Also: Android. If I didn't need Android/iOS apps, I'd be using a Nokia 3210.