In my Opinion a Oneplus 6 with PostmarketOS (real Mainline Linux) and Gnome Edge is by far the most secure and best possibility right now.
https://www.youtube.com/watch?v=wOmRMg546UY

In Future it will be libre-soc.org or the Company-Spin-off from RedSemiconductor.com.

The Cool Thing is that there are even Anti-Temper-Circuits in there and you have Control over Ring -3, Meaning Full-Hardware Control over every single Transistor. Except things like pcie ddr... which are still hard-makros. But by Far the most private and secure chip in the World.

Also it is does not have any Accelerator at all. Meaning everything is done by the CPU-Cores and Controlled by you but extremly efficiant. Simd at the Developer-End gets automaticly Vectorised. No Opcode-Proliveration, no Overhead between CPU and Accelerator (GPU,VPU etc), no tear-up and tear-down cases, sec-fault on boundary etc. 

The Team is Centered around Luke Kenneth Casson Leighton. lkcl on that stupid censored Platform named Youtube. Search for libre-soc on his Channel or Playlist. Also It is getting ratified by IBM right now. All Open-Source Hardware and Software!

Check out libre-soc.org and their mailing-lists for more information.