* Verified boot (https://source.android.com/security/verifiedboot/) like stock Android (almost all ROMs disable this) and with your own signing keys
* Latest monthly security updates from Google
* OTA updates from S3
* No Google services
* Latest F-Droid as open source alternative to Google Play store
* Latest Chromium w/ adblocking and privacy patches
Question about this - my blackberry q10 had an android vm on it but the limitation of "no google services" meant that unless the app used none of those APIs it would not run. Surprisingly this was very limiting - have you had a similar experience?
Eventually, what is needed is something like reproducible builds so that you can claim that this binary corresponds to this source tarball. I don't know where AOSP stands in that regard. The keys should be the only thing that users should ideally manage. i.e., You get the generic binary (that is known to correspond to source tarball), sign it with your keys, and flash it. Just throwing ideas. This may not be in the scope of your project.
I am not saying that you shouldn't try rattlesnakeos just that the people you would be installing it for, still have access to everything on your phone.
If you value your privacy you would buy a simple dumb flip phone, solder out the microphones and cameras and use a wired headset. They can still get an approximate location of you through stingrays and such but it's better than nothing.
It's actually pretty liberating to have a purpose driven cellphone to only communicate with.
https://github.com/AndroidHardeningArchive/Auditor/releases (though sadly Copperhead's fdroid repo is dead)
A company that did the heavy lifting for startups that want to reimagine the user facing side of (eg. LineageOS compatible devices) would be an interesting proposition.
How difficult would it be to port this to another phone like the 1+n?