It's ludicrous to claim software with signed releases isn't open source. Having private keys used to generate the signatures for APKs, updates and the vbmeta image doesn't somehow make it not open source. Every APK is signed and the software isn't somehow not open source because the signature requires the private keys. There are standard tools to compare APKs with different signing keys to ensure the build is reproducible and the same thing exists for the OS as a whole which contains many signed APKs and a signed vbmeta image with verified boot metadata.

The signatures enable the update client to verify the releases and the firmware to verify the OS with the public key flashed by the user as part of installing the OS. Signed updates and verified boot fully work with any build of GrapheneOS following our build instructions. Auditor and AttestationServer also work once they're rebuilt with the new verified boot hash included.