If you can't self host it, you can't know it's not a honeypot.  

 Is GrapheneOS legit? How about their auditor server? 

 Good question.