GrapheneOS has a security feature called "Disallow USB peripherals when locked," which is similar to the Linux app "USB Guard." There's also another Linux tool called "USB Kill" that takes things a step further by acting as a kill switch, instantly shutting down the computer.
I was wondering if the GrapheneOS team would consider implementing a "USB Kill-Switch" feature. The idea would be that if a GrapheneOS phone is in the vulnerable "After First Unlock" state and detects a foreign USB device, it would immediately shut down and revert to the "Before First Unlock" state. This would make physical attacks not just ineffective but actually backfire on the attacker, who likely wouldn’t know about the kill switch. SO the attackers OWN tools would actually end up helping the user. Basically I want to ensure that any seized device will be in BFU mode no matter what.
I get that there's an "Auto-Reboot" feature, but that still leaves a small window of opportunity for an attacker, which could be enough for them to compromise the device. A "USB Kill-Switch" would completely close that window, no matter what the auto-reboot setting is.