One way or another you’re still temporarily sending your credentials or token to them even if they don’t store it

not sure if it would be privacy conscience to share credentials for all of these different apps.

No, it would not.

Weird, just dropping a pin on the map works for me. I don’t use it a lot, but I just tried a dozen times at random and it worked every time.

OSMAnd~ absolutely does have navigation. Fully offline to boot.

And the second and forth points are already solved using client certificates.

You mention old hardware is generally exploited physically, but we’ve seen a number of critical bugs in CPUs in recent years such as Specter and Meltdown that can be exploited by just visiting a website. Yes these can be mitigated by the OS, but alluring that hardware bugs are not exploitable remotely isn’t quite correct.

Yes tasks.org. EteBase is the server backend for etesync (the client side). EteNotes is one integration, but others are possible too!

It’s a fully client-side encrypted key store, mainly used for calendars, contacts, tasks, and notes. It does have a cal/carddav bridge. I use task.org for tasks, EteNotes for notes, and the android connector for native support of calendars and contacts. In GNOME it works via evolution for syncing. I use the *dav bridge for some custom integrations (like HomeAssistant).

Etesync. Open source, self hosted or cloud, cross platform, and fully client side encrypted.