What happened to running what you wanted on your own machine?

Never underestimate how much things could get worse, touché

Check how Play Integrity works today (DEVICE and STRONG integrities) and how it uses a non-extractable hardware key fused into the chip or security processor. Or read the GrapheneOS attestation guide and their example code. It's un-spoofable hardware attestation.

The fact that you can make it pass in some cases using Magisk and so on is because it's spoofing an older device (launched before Android 8) without hardware-bound keys and Google is deliberately allowing that in order not to blacklist the genuine users.

However, once Google decides that the collateral damage is tolerable and those devices should no longer pass Play Integrity, then it's game over. You can't spoof any newer stuff, as you can't produce the desired signature -- only the hardware can do it and the hardware won't do it.

The only way would be if the manufacturer screwed up and it's possible to run unsigned code (or signed by a different key) and maintain a pristine bootloader, or if the hardware key leaks somehow. In either case, the key is per device so Google is always free to blacklist that device if it really wants to. (Verification of the signatures is always done off-device, through Google's servers.)

So what actually happens in Sweden: there are two officially sanctioned authentication apps: BankID (originally developed by banks) and Freja. Both only run on a mobile phone.

For government services, both will work. But you must use some of them, otherwise no government for you. You can still do some things by paper, but those are getting rarer and rarer nowadays. The general assumption is that everything is done online. Some government services can't be done by paper or physical visit, not without involving this authentication at some point.

For most of everything else, only BankID (the oldest of the two and the most deployed by far). Especially for banking, only this works. Even if you call the bank and try to sort out via phone, they will refuse service until you can prove that you are you by authenticating via BankID.

But Sweden is mostly cashless nowadays (even some bank branches are refusing to deal with cash). For example, you can't take a bus or train and pay with cash. You have to use a vending machine that only exists on train stations, or depending on which kind of transport and the region you live you might be able to do a contactless payment, or you must use the app (the default choice that 99% use). If you use the app, to pay you need to use a "card not present" flow, or Swish (Sweden's mobile payment system), and to complete either you must use BankID. You can't use your card or do any payment without BankID (if the card is not present).

Even if you do use your card, if it gets denied for any reason, for you to sort out the issue you'll need the mobile phone and BankID.

If you go out with friends to a restaurant, most restaurants don't accept cash. If the restaurant doesn't accept charging each one individually then someone needs to pay for the group, and they will expect you to pay them via Swish which requires BankID. People won't take cash either.

As you can see, it's not actually trivial here to live as part of society without a working mobile phone. If you're outside, you better have 100% faith on your card, and/or be prepared that you might need to walk back home as you can't do much now, might not even be able to buy transportation.

Some smaller shops/kiosks only take Swish: no cash, no card. That requires a phone plus BankID.

If (or better said: when) BankID starts requiring the device to pass Play Integrity, then not only you must be carrying the device at all times, but it must be a blessed device from Google or Apple.

In Denmark the situation is very similar, and in their case their app (which is called MitID) already mandates that the device has to pass Play Integrity.

I'd go with

1) sign a petition on change.org against that APK lockdown (currently 10.5k votes) - https://c.org/BHZzNvR6pr

2) In your Android device or Google account use "Send Feedback" and articulate yourself or "Contact us" in Android under "System settings > Tips and support" or best, if you are paying subscriber for any Google LLC service, send the feedback through the subscription management channels (such as feedback in Google One, Workspace or any other paid service)