In the installation page, it says two things:
Even if the computer you used to flash GrapheneOS was compromised and an attacker replaced GrapheneOS with their own malicious OS, it can be detected with these features.
Installing GrapheneOS flashes the GrapheneOS verified boot public key to the secure element.
What I wonder is why isn't it possible for a compromised OS which is used for flashing, to give a false boot key together with the malicious OS?
I trust you that it's not not possible because you have clearly stated that it's safe to use a compromised computer to flash GrapheneOS to a pixel phone. Safe because it would be detected if it was a malicious OS.
But I would just like to learn what is stopping adversaries from doing placing their own boot key in the secure element during the flashing.