Didn’t read this particular article, but using a pi as a router works rather well. I’ve been using one as my main router for years now, with openwrt. You get a CPU fast enough to handle QoS without issues, more than enough power to run a few additional things if you want to (wireguard, AdBlock, …). Only thing is : the wifi is trash. Doesn’t matter for me (I just use the integrated wifi for a guest network, main network have dedicated APs)

I went the /e/os way and quickly turned back. Not to dismiss the effort of the maintainers, but it really felt like a frontend on lineage os meant to sell alternative cloud services. I did not find convincing arguments over a bare lineage os and the pretty much forced /e/ cloud was a total turn off.

I went the “real” security / privacy way and switched to grapheneos. Very happy overall, already went thought with 2 major os updates, no issues whatsoever. Only issue would be if you want Google pay (won’t work on graphene). You’d need a pixel phone if that’s in your budget. The pixel phones are great at photos, but pretty “meh” otherwise

It is also a huge deal because since (at least in France) the government forced ISPs to log DNS queries, a lot of browsers (and latest android and iOSversion’s) have now migrated to DNS over https or TLS DNS, which means that the only clear text DNS query they can intercept is the one to fetch your secure DNS service address. Now, having a trusted CA installed in browsers means that they can also spoof the identity of this secure name service, and regain a bit of control.

They invested a lot in surveillance technology (for both good and bad reasons), and https, DNS and encrypted messaging / phone calls means this was all for nothing.

And yes, by being authorized as a trusted CA, you can effectively spoof pretty much anything by setting a proxy. Some tools even leverage this for app analysis. Look up mitmproxy for example, or squid. A lot of companies already do this to inspect inbound / outbound traffic.