I've just decided I've had enough of Proton. Too many problems, too much work to troubleshoot with Help.
I was about to sign up* with Filen, but then I noticed that they do not have gpg signatures for their clients.

This is all too common in the major cloud services:

Proton Linux client has no gpg signatures
Filen has no gpg signatures
Mega has out-of-date instructions for its signatures, now that apt-key has been deprecated. I can't get it to work.

Why isn't the market - i.e. users - communicating back to these companies that its just not good enough not to have signed and verifiable packages?

End-to-end encryption is really important. But if you can't trust the client - what happens pre- and post- encryption - its useless.

In fact, its worse than useless. You are permitting unvetted software on your system - it has access to EVERYTHING. That's crazy! And if that's you, why are you even bothering with Graphene? (Although, in fairness, its not a corporate surveillance issue probably).

And no, SHAsums are not adequate.

So, what options do GrapheneOS users recommend that:

have verifiable clients (with clear instructions?) - no, no builds please.
support Linux and Android/GrapheneOS (integration with reputable packages e.g. RClone (I think) also okay, as long as making it work is not technically demanding).
functional: a solid cloud based drive that can integrate into both platforms. Calendar, email, etc are superfluous.
credible - looks like a real company that isn't 'doing the dodg'. EU hosting a plus.

Is it the impossible idea?

Actually, I did sign up to Filen (based on positive recommendations here), discovered the gpg problem and then requested a refund. They were brilliant: they acknowledged the issue and refunded me with minutes. Kudos.