Is its bootloader unlockable, or locked to Graphene? Graphene seems to be trading freedom for ‘security’.

Refuse it, ask for a chip card-based solution, which is very feasible. EU will require banks not to ask for smartphones with the PSR.