Hmm the thing that's suspected to be causing AOSP ROMs to not pass is because signature spoofing that had been introduced by PE's PixelPropsUtil since A14
It also explains why <=A13 AOSP is passing

And also some A14 AOSP ROMs that do not spoof signature like le new official Lineage 21

So known types of ROMs that pass device with latest PIF:-
* MIUI/HyperOS ROMs
* <= A13 AOSP ROMs
* Some A14 ROMs that do not spoof signature like Lineage

That's is of course provided that
1. The FP itself isn't banned yet
2. You're not using a kernel with a banned uname string like Strix using -openela
3. You have nuked any ROM-sided PIF or software attestation framework injections (they don't work)

...and I have now found a deal-breaker bug that will force me to flash another HyperOS ROM
And that is, Webview is constantly hanging and never loads anything
Tried to fix via modules like Open Webview and using different providers like Mular and Thorium Webview and nothing, went ahead and manually updated stock Webview and still nothing

This Webview bug is a deal-breaker because certain apps need Webview to stuff like Gmail to render the mail to read or GitHub app to render READMEs or to literally login in a certain food delivery app I use 💀

Maybe Yar_Zloy got it fixed in newer releases of his ports? Welp, I'll try and find out within the next 24~48 hours I guess

If he didn't and the bug is still there, welcome back TRM
Yes, A13 HyperOS

It seems that my suspicions are correct:
https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89526334

AOSP roms must be sign!

RIP unofficial builds from jimgsey and bezke 😢

If official then wait for next build to be signed

Pretend this is Google CEO instead okay?

And false alarm
https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89526197
Feel free to use Strix I guess

Update: I did flash it, looks like he did solve it

And now I'll have to flash TRM because selinux is permissive and the rom falls apart when you make it enforcing

Welp, I tried to have a pleasant experience with A14 HyperOS, oh well..

It's confirmed :)

Signed builds pass DEVICE integrity and we can dirty flash from unsigned to signed builds using a migration script.

Yar_Zloy's HyperOS Global 1.0.3.0 is good, but the webview bug kills it
But his CN 1.0.6.0 is so heavily modded with also selinux permissive

My signed LineageOS build pass Device even with vbmeta disabled and built as userdebug (adb root disabled).

Confirmed, now DG checks for unsigned roms.

All AOSP maintainers must sign their ROMs if they want to pass Device verdict.

For "mortal" users, ask your ROM maintainer if the ROM is signed.

Official LineageOS builds are signed with their keys, so it should work.