Since you also want protection from Apple, you actually don't disagree: right now, Apple can put your phone in DFU mode and "upgrade" its software to a new buil

Since you also want protection from Apple, you actually don't disagree: right now, Apple can put your phone in DFU mode and "upgrade" its software to a new build which gives them not just root access (which isn't terribly useful these days) but complete control over the kernel. (They still can't steal your data unless you help, due to disk encryption, but that's an unrelated topic.) I want a phone where Apple can't do that; but I mean, someone has to be able to do that, as otherwise the software on the phone can't be upgraded. So I want the person in control of that to be me, the owner. If I so choose, I can trust Apple's software. Or I can choose to not trust Apple's software and trust software from you. This concept of software trust eventually comes down to a root certificate (just as it already does), which should be controlled by the same secure enclave as the disk encryption (so the software itself can't alter my trust roots in case of an exploit). There: not only easy to be equivalent to what you have, not only able to give people like me actual control, but more secure than the status quo (as Apple can be locked out), not less.