Fair enough. Opsec is not at all my domain of familiarity so I've no idea what challenges it might present to do it properly.

This is the solution, right? You get someone else to buy the phone for you. This necessarily will practically speaking be probably be someone who knows you, but it adds a layer of indirection.

The unregulated pharmaceuticals distribution market relies on burner phones and seems pretty solid despite effectively continuous attempts to conduct surveillance on them.

Perhaps not something insanely obvious like Grouch Marx moustache and glasses, but more subtle? I'm not really very well aware of how advanced face recognition, etc. is at this point in time though. But I'd guess anyone who cares enough about opsec to go through this process might also be decent at passable disguise techniques.