(1) Keep manufacturer's Android plus some plausible apps and data in a reserved part of the drive. (2) GrapheneOS runs from the other part of the drive. (3) Make sure PIN screen designed to not give away the OS. (4) When duress PIN is entered, erase GrapheneOS and restore manufacturer's Android. (5) Now you won't be charged for having GrapheneOS because they won't know you had it.

As things stand right now, software is 1-A protected speech. I'm not sure how long that will be the case with growing authoritarianism, specifically wrt to tech, on both sides of the aisle. I am concerned it may be considered probable cause though -- like how you can legally have an ax in the bed of your pickup but it's a free pass for a cop to search your vehicle if they're so inclined -- but really, they can manufacture probable cause for anyone if they want so it's kind of moot. You may be attracting unnecessary attention though if you've got "GrapheneOS" on your lock screen. But this goes back to my original point, they still have to catch you in the first place.