I just use the Google keyboard, installed from Aurora. I disabled its network permission so it doesn't send any data back to Google.
Discussion
If you don't trust Google, why use Google?
Because I've eliminated all other Google services from my life. Having an offline keyboard made by Google isn't that big a deal for me.
It's a keylogger if you keep it online though. And eventually there'll be an open source keyboard that can stand up to Gboard.
I wouldn't trust their "offline" setting. There's no match for Google Maps, and I still refuse to use it. I'd prefer less features if it means not giving them any data, including "number of installs/hits".