Afaik google-pay is prone to fail even with faked safetynet. Magisk can also fix safetynet, but I don’t want to enable root-access. Kinda dumb that the way to fix overcritical security checks is to break security even more. :)

Thanks for the idea though.

Custom roms with relocked bootloader only work on pixels by design. You’ll have to live with an unlocked bootloader.

As for easy installs, Murena’s e/os exists with support. But I can’t vouch for their cloud ecosystem. Other than that, maybe an officially supported lineage device. You will lose safetynet on both unless you want to root.

For now, NC Deck does what I asked. Even if it’s bound to Nextcloud, that’s at least a server I trust. I also used Markor as my editor ever since switching to Android, it seems to have a todo-focused Markdown extension with linking other files. Looks powerful, maybe I can build something with it.

They do have SQLite on their Roadmap, so maybe there can be a standalone app at some point.