This is really important for me, too. The LineageOS build that Andromeda uses allows signature spoofing and microG has the permission but still fails the self-check. I don't know enough about Android or Andromeda to figure out any more than that, though.