Rooted Android users commonly use a keybox file along with modules like Tricky Store and Play Integrity Fix (PIF) to spoof device attestation and pass strong integrity checks so that banking and other security-sensitive apps work on unlocked devices. However, this workaround is expected to stop working beginning in February 2026.
According to the DroidWin report:
Source: DroidWin — “You do not have permission to view the full content of this post. Log in or register now.” (Jan 14, 2026)
According to the DroidWin report:
- Google will require Remote Key Provisioning (RKP) for devices that support it (typically phones launched with Android 13 or newer).
- RKP provisioning servers will start issuing certificates signed with a new RSA-4096 attestation root certificate from February 2026, replacing the older RSA-2048 root.
- Because of this change, devices with unlocked bootloaders won’t be able to use leaked or patched keybox files to pass Device or Strong Integrity checks once the new root is enforced.
- Google plans to fully transition all RKP-enabled devices to the new root by April 10, 2026, after which old-root based workarounds will be effectively blocked.
Source: DroidWin — “You do not have permission to view the full content of this post. Log in or register now.” (Jan 14, 2026)