As far as I understand, this is done for every application installed. Every time. And it seems that the certificates are not unlimited and they will have to be renewed.
GraphenOS is supported only by Pixel. So we're waiting for a port to other devices! Although I think it's impossible, since only Pixel has a security chip.
You made the right choice by coming here.