You can use Bisq for off and on ramp, and then you can use Hyperliquid for perpetual and spot. Both don't require KYC and Hyperliquid has supported direct bitcoin deposit and withdrawal. Therefore the principles still hold up with a little more digging for information.
Bisq is non-custodial, yes, but not entirely trustless. This May, for example, they lost about 11 BTC to an exploit where the attacker specified a negative miner fee value that was not properly validated by the v1 protocol code. This allowed the attacker to empty out the funds of active offers. The exploit affected altcoin trades only, not fiat trades or Bisq 2.
Sure, there iss no central entity and no KYC, but trust in a third party does not completely disappear. It just shifts to trusting the code to be bug-free.
Well yeah, it's one of the rough edges, don't trust but verify, but by verifying doesn't necessarily mean we can get to know zero day exploit.
We just verify the code is working as intended. The thing is, if the exploit was caused by a bug, does that mean there is some level of trust on third party or we simply didn't do a good job verifying it?
My opinion is that, we didn't do the job good enough but I believe the principles still holding up.