@pu @JdeBP
If “some of the donors are American companies” presents a problem, then I think none of them would work. If open development and an ability to fork are sufficient, then I would say it’s time to invest in EU teams that monitor the open development process and maintain forks/distros.
It’s still a good question, mind you, and as an American I think it’s a good time to invest in independence from the US.
All that said: OpenBSD’s great and simplicity is probably more auditable.