As I said twice, LineageOS allows the exact signature of MicroG to replace the exact signature of GMS (core google play services component).

An app signed as MicroG can't spoof anything other than GMS. Nothing with any other signature can spoof GMS. An app not signed as MicroG cannot spoof anything.

I'm unclear what the problem is here, because the desired outcome is MicroG replacing GMS and that is exactly what LineageOS allows, without allowing anything else.