Do not use Obtainum
When using Obtainum you must trust all developers and all platforms they use to push updates.

How do you verify apks using Obtainum?

Check twice what this girl is saying. She's a privacy, security celeb i.e. "expert"

When it comes to GrapheneOS. 
Disable auto-updates and their App app. 
Disable all connections to Graphene servers. 
Don't allow them to collect data about you.
Download updates using Tor and sideload them. 

 Not sure downloading through Tor changes the fact that there's an element of trust with app developers. 

Disabling updates is a security risk.