Here's my report on the successful process: Before flashing TWRP, I did unlock/lock/unlock the bootloader, and only the first time I set up the fingerprint and device password, so after unlocking it the second time, there was no password set, but twrp asked me for one, so I entered the one I did use before, and it was accepted, and then I formatted userdata to decrypt it, and set up that part from scratch.
Another thing I noticed: With an unlocked bootloader, you get the "this device is unlocked" message at power on, and it asks you to press a button during a 5 second countdown to enter a menu where you can chose fastboot, recovery, power off etc. - however, selecting recovery in that menu doesn't work (at this time neither for stock recovery, nor for twrp). Instead, I have to let the 5 second countdown pass and then as soon as this screen is replaced with the 1+ logo, press the volume down button in order to enter twrp. Works every time, it's just something you have to know.
Other than that, I've been successful at flashing XPosed, installing the xposed framework installer, installing XPosed on the device, and installing XPrivacy into XPosed. Works like a charm!
(Now the fiddeling begins, what must be allowed for the intended functionality to work, while not exposing too much data about me to Google and other "Big Brethren").
The last step will be to import contacts (from vcf file or Nextcloud as soon as I get it set up) and inserting a SIM card or two into the device
