>I don't believe hardware integrity spoofing has been accomplished on Android yet.

It has, but extracted keys aren't free.