Build yourself, using your own signing keys and your own patches (if you need any - I do). There are various Docker images with everything necessary in the Doc

Build yourself, using your own signing keys and your own patches (if you need any - I do). There are various Docker images with everything necessary in the Dockerfile and user needs to only specify the device's model name (and any extra options, like build type). Takes some time but the only thing one needs to trust is the source code (which is nearly impossible to fully audit, though)