So you manage your own encryption keys for cloud files? Thats pretty much the only way and even then you have to trust Apple because it’s closed source.

They have full control over your device. It’s the same for Whatsapps encryption, where Facebook can still access everything on your decrypted client.

CalyxOS doesn’t support the FP5 yet but they are working on it. I have been using it for like 2 years and the only thing I miss is a sensor permission like the one from GrapheneOS.