Since the issue is only on the ssh server side, it does not even matter if it is installed, because it would not normally be running. Ssh'ing to containers does not seem like a common practice at all.

AllowedIPs is a client side restriction that can be ignored anyway, no real security benefit from not just putting your entire network there.

You can just specify AllowedIPs in the wireguard client config to route only traffic to your services through the VPN, works great.

The EU already has alternatives, quite a few banks have their own NFC implementations.

Snap is Canonical's project AFAIK

A well-made online gambling "game" is harmful

If you choose to run linux-lts, sure, but the plain linux package also exists and is at 6.19.9.

He probably means Ubiquiti network gear

Yes, but it is a binary blob that Google makes and Firefox just integrates with. If it is not released for a specific platform, Firefox can't do anything about it. At least a while a go it was quite an adventure to try and get DRM working on ARM64 Linux: https://www.da.vidbuchanan.co.uk/blog/netflix-on-asahi.html

This is good even if you don't care about Chrome, because it means Widevine should become properly supported on the platform.

I don't get Google's "iOS, but worse" strategy, I'll just buy a fucking iPhone then.

They don't need to stop, GrapheneOS will just be an officially supported alternative OS. Their own Android flavour can still be as full of crap as ever.