Remote hardware attestation is the problem. It's the only thing that prevents me from simply circumventing the bank app's silly checks.

Cryptography is great when it empowers us. It sucks when it's used against us.

It's great that your integrity status reports that today, what's the guarantee that it will stay like that in a year?

There have been so many examples of companies, especially big tech, rolling out updates in the name of "security", that just turned out to be a way for them to tighten their control over time.

It's probably Play Integrity, indeed, which most of all checks if the user downloaded the app from the Play Store (and so requires a Google account, and being logged in to it on the phone).