This is not an issue specific to Linux, Windows installations can be downgraded as well. As for the mechanism, UEFI devices, alongside key updates, also get revocation list updates.
With Open Camera, my device (and seemingly many others) have phantom cameras with IDs that crash Android's camera server if accessed. When that happens I have to restart my phone. Open Camera does not have a way to blacklist those. There are several issues open about this on the issue tracker but they have been open since 2020. This is not an easy problem to fix (LineageOS uses a manually populated key called "config_ignoredAuxCameraIds" in device trees to solve this for their Aperture camera app) but at least an option to filter those out manually if I know what I'm doing would be nice.
The other two prominent open source camera apps are Fossify Camera and PhotonCamera. Fossify Camera does not support multiple lenses yet. PhotonCamera is nice because it does image processing and handles my camera lenses correctly but its UX is janky (on my device, with default settings, taking a photo takes 7-8 seconds and quitting the app before the process is complete loses the image), it's not on F-Droid and it doesn't automatically switch between lenses with zoom changes. There's also FreeDcam but I'm not a professional photographer and I'm certainly not going to buy a color calibration reference card that costs more than a hundred dollars.
It sucks that on my phone with /e/OS, instead of using a FOSS camera app, I resort to using Pixel's camera app with internet permission disabled to be able to take advantage of my hardware.
I've been using /e/OS on my phone for a few months now. It comes with built-in DAVx5. Their hosted offering is just another provider and using your own cloud provider is the same process as using theirs. Even their device locator integration is independent from their hosted offering. Of all the Android distributions I've used, it's the one that does providing a hosted service best and it was honestly refreshing.
I have a TicWatch Pro (catfish) running AsteroidOS nightly. If I turn Wi-Fi on, (understandably) its battery drains fast and it gets kinda hot so I leave it off. (I don't know if this is the case for other AsteroidOS watches.) I personally wouldn't recommend it for this specific task even though it's great for anything else.
I use Bazzite on my Steam Deck for better Btrfs, Decky Loader and Waydroid support. Support for these things on SteamOS via community projects are fragile (Decky Loader breaks often with Steam updates, steamos-btrfs runs a payload that may or may not work after updates, the widely used Waydroid installer comes with prebuilt kernel modules which I am not okay with). Bazzite has purposes other than installing SteamOS on unsupported devices.
That's more on F-Droid, no? If someone said "Download from Cydia", I would not expect it to download it from Saurik's official repository called "Cydia/Telesphoreo". Using the same name for the app (store kit) and the repository is just a bad design choice, especially if the reference implementation comes with only the said repository.
I got every self-hosting sysadmin I know to run certificate monitors for sites they maintain but it certainly isn't a common thing to do. I know Cloudflare has a beta certificate monitoring feature which would certainly help a lot with this problem considering their market share if they enable it by default. (Although one problem with this is that they issue backup certificates from other CAs so it'd easily trigger warning fatigue!)
(I wasn't aware of your credentials when I made my previous comment so I assumed you didn't know about mandatory certificate transparency which is a mistake on my part, sorry! I'll make sure to check profile about sections before I assume again.)