Esam As n3t_admin writes, a network connection is not needed to hash a large file, check the hash against the signature, and check the signature. Having a network connection is also not needed for applying a delta update -- or for sideloading an OTA image via adb, where the device doesn't have a network connection because it's in Recovery. Because a GrapheneOS update is signed by the project, it doesn't matter how the update arrives onto the device.