GrapheneOS currently doesn't use out-of-date updates to APEX +
GrapheneOS currently doesn't use out-of-band updates to APEX components, so these are all signed with the OS releasekey and verified boot key to avoid needing many extra pairs of keys. Each APEX needs an APK signing key and verified boot signing key. If you want to ship out-of-band