DivestOS is a slightly modified Lineage version that officially supports relocking on some phones (in contrast with Lineage, which I think can be relocked but explicitly tells users not to do that). It also has sandboxed implementations of both official Google services — ported from Graphene, I think – and microG.

I'm using it with microG, bootloader relocked, and it seems to pass SafetyNet this way – at least the apps that didn't work on Lineage seem to work here. (I haven't yet tried Google Pay, though – I think it will require proper GApps.)

https://divestos.org/

Edit: by the way, banks requiring hardware attestation is probably a U.S. thing – in the EU and ex-USSR countries banks seem to not care about that at all (although some don't like it when you root your phone).