I don't think the attack can work as described here. One of the features that GrapheneOS lists is:
reply> Insider attack resistance for updates to the secure element (Owner user authentication required before updates are accepted)
From my understanding, this means that even if you do have the signing keys, you cannot install an update that would remove the need for knowing the screen lock to unlock the filesystem's encryption - as installing such an update requires entering the screen lock first.
However if you have signing keys and access to the update delivery infra you could just publish the update and wait for it to get auto updated before starting to seize the phones.
replyTo my knowledge this is true for normal android as well (perhaps not that authentication is required); the data is encrypted against the passcode.
replyBut the phones were also under some form of MDM, maybe they could have used that?
reply