They previously did not use APEX but that seems to have changed recently: https://github.com/GrapheneOS/grapheneos.org/commit/7bf9b2671667828d1553c92bf4f64cc749b74d0b Regardless it will need the verified boot keys it seems so Google can’t update them, likely the devs will take responsibility to update the CAs. No idea if they will restore the user control though.