Your question is interesting to me because I think one can state that there are technical trust mechanisms and there is social trust; that is, social trust in a project, its leadership and the developers. You have a reply already about the technical trust mechanisms. I offer that social trust is also worth discussion.
Perhaps we could say that social trust is earned and from my perspective the GrapheneOS project, its leadership, and developers have really earned my trust.
How does a new user evaluate this social trust for themselves when arriving at the project? I am fortunate to have followed this project since CopperheadOS but my approach for a new user is to invite them to read the documentation on the website.
The GrapheneOS documentation is special, very special. There is everything you need on the website: the how to do something, the technical descriptions and, very unusually, the very detailed explanations of why something is as it is and what alternatives you might have.
You cannot come away from reading (all) that documentation and not know that the writer cares about the project and the users; and for me this is about social trust.
Writing documentation like that on the GrapheneOS website is what I would call earning (social) trust - and in a big way. I cannot thank those involved enough, ever.
some further thoughts ...
The concept of social trust in the GrapheneOS project was touched on in a recent, otherwise positive, review of GOS by lwn.net. Reading the review, the responses and the misunderstandings made me very sad indeed because I have followed LWN/'the editor' since 1999 and Graphene/CopperheadOS since 2016. Both are very, very special contributors to the free/opensource domain.
I was sad because the lwn article touched on the social trust issues and there were two problems:
Firstly, the writing style. The lwn 'grumpy editor' house style and its wit has been loved and cherished for more than 25 years by the readers. It is reserved for the free/opensource projects that touch on the editor's personal life, like a mobilephone OS ... but, if your first encounter with this style is through a subscriber link to an article about a project you cherish, then you have little hope of grasping the esteemed editor's self-deprecating style.
Secondly, the lwn article brought up some history and had a rather negative discussion on issues of (social) trust ... but failed to mention GrapheneOS documentation and all the positives it implies about the social trust a user can have in the project.
The 'editor' is a busy guy and reading the article, as a GrapheneOS user, I doubt he had had the time to read all the documentation ... and so I suspect he missed the opportunity to realise that the GrapheneOS project really earns and deserves social trust through its excellent documentation.
(These are the further thoughts and remarks I would wish to have added to that lwn article's comments if our community manager were so willing to oblige).