I feel there are plenty of local activist/independent servers all over the EU. As long as you mind the encryption/anonymization, you can even round-robin them. Having a central EU authority is better than Google/Cloudflare and should be safe, if the implementation is sound. But there is a lot of room to meddle.

By LeOS? Any GSI-Treble enabled Android phone. So most any phone with an unlockable bootloader. You can use the treble info app to check or search online.

https://gitlab.com/TrebleInfo/TrebleInfo/

LeOS isn’t very popular, because it’s a passion-project by one guy, with little marketing. Said guy is a somewhat opinionated Woodstock-era hippie, hence the colorful icons (they can be easily swapped via an icon-pack of your choice.) Though he is a friendly person.

To my knowledge it’s the only Treble-option with a hard stance on de-googling. Specifically made as an answer to some policies in eOS. There is an interview with him floating about, if you want the backstory. https://nixfaq.org/2021/01/exclusive-interview-with-guntram-lead-developer-of-a-popular-custom-degoogled-android-rom-called-leos.html

Hey there, for starters A-GPS, stun, secure DNS, and several other preconfigured servers default to Google. Some of these can be changed with ADB. Check out a guide on de-googleing LineageOS for a more complete list. It’s not AOSP, but close enough. There are also Google servers configured in the sources. How valuable those connections are, depends on your threat-model. If you’d like a paranoid GSI, check out LeOS. It’s probably the most complete treble-compatible option. AOSP by default, isn’t very private.

And have a script to secure erase the key material. Much faster and will prevent forced/coerced unlocks.

An advantage of Tuta and Proton is, that there is a basic free tier. Your Mail is a center-point of your online activity. Hoping it to never happen, if you ever can’t afford the (cheap) price, you won’t lose access to your mail. Which would suck, for all accounts linked to it.