Security and freedom concerns. Alternate installation method?

[emanruse]

Hello,

I have been looking for a way to install dnscrypt-proxy on a Replicant device for the purpose of better security and privacy. However, I notice the current project suggests installing Magisk - software which I haven't heard of before. Although I checked the GitHub page of Magisk, I also had a look at the F-Droid page of Magisk. Things which immediately caught my attention:

• Anti-Features: This app promotes non-free add-ons (I have no idea how it does that)
• Permissions: a quite concerning list. Why should one install an app which can "use biometric/fingerprint hardware" (if one is present), "have full network access", "query all packages" and so on? All that just to flash a downloaded zip? This contradicts the basic security principle of minimizing attack surface. In fact, the whole idea of using an additional app with additional permissions is itself a security contradiction.

So, could you kindly suggest a process which includes only installing dnscrypt-proxy and not anything else, e.g. using ADB? (Replicant has root out of the box)