Those certificates should not exist in first place. That is just a bad design.
kolorafa
Best to buy phones that you can relock your bootloader, from memory I can only think of 2 phone manufacturers that allow that: Fairphone and Pixel phones that allow you to relock bootloader.
I bought Fairphone 5 with Degoogled /e/ OS from Murena to avoid that annoying cat and mouse game. I bought from murena website to get my phone already with degoogled firmware flashed.
In my case bootloader is locked with google attestation so 99,9% apps works, including Banks apps with TAP to pay. Bank payments that dont use google pay but implent NFC directly works (so except for google pay other pay method should work).
Both my bank apps works with tap to pay, But Your milage may vary.
Im happy with my phone. Due to all that, not a single app had issues with "valid OS checks" because it actually is valid, it did came directly from seller and never got unlocked/flashed.
It is locked but I should be able to unlock bootlader, flash different firmware version and lock it back up making the attestation valid again but didn't do that yet so can't be 100% sure.
Few hours later on timeline:
https://lemmy.world/post/23832012 (Apple randomly spying using microphone)
Just go to the settings, apps, Tusky app and click "open defaults" or something default dont know how its called in English. It will unset all default targets of that app.