It seems that my suspicions are correct:
https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89526334

AOSP roms must be sign!

RIP unofficial builds from jimgsey and bezke 😢

If official then wait for next build to be signed

Pretend this is Google CEO instead okay?

And false alarm
https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89526197
Feel free to use Strix I guess

Update: I did flash it, looks like he did solve it

And now I'll have to flash TRM because selinux is permissive and the rom falls apart when you make it enforcing

Welp, I tried to have a pleasant experience with A14 HyperOS, oh well..

It's confirmed :)

Signed builds pass DEVICE integrity and we can dirty flash from unsigned to signed builds using a migration script.

Yar_Zloy's HyperOS Global 1.0.3.0 is good, but the webview bug kills it
But his CN 1.0.6.0 is so heavily modded with also selinux permissive

My signed LineageOS build pass Device even with vbmeta disabled and built as userdebug (adb root disabled).

Confirmed, now DG checks for unsigned roms.

All AOSP maintainers must sign their ROMs if they want to pass Device verdict.

For "mortal" users, ask your ROM maintainer if the ROM is signed.

Official LineageOS builds are signed with their keys, so it should work.

Updated ver that doesn't touch fonts.xml over at /system/etc
Useful if your lock screen sytle breaks in HyperOS ROMs

We have generated private keys for use with all upcoming Official releases.

https://github.com/Evolution-XYZ/vendor_evolution/commit/eba557898e59877d343b8bb506d50fc20d2efaee

UnOfficial maintainers can continue to follow the LineageOS signing guide.

Let's see what jimgsey and bezke will do about that...

In the latest Telegram Android beta, Telegram server may request client to do a Play Intergrity check at any time with error code INTEGRITY_CHECK_CLASSIC_ X, then the client will perform a Play Integrity check and resend request with invokeWithGooglePlayIntegrity method.

Next ROMs in queue after this:-
1. Multiple A14 HyperOS ROMs (if I found one that's great and doesn't suck, else I'll try to fix the webview issue by myself back on 1.0.3.0 Global by Yar_Zloy
2. DotOS A11 (actually just to see if it will pass device, if not because it's unsigned then the theory that <= A13 passing is false)