We can't let Google get away with bundling their spyware in the name of security into a phone we must now have..

It's NOT ok that a government app (often practically mandatory) requires the user to accept some invasive ToS of a foreign corporation maintaining an illegal monopoly.

Requiring attestation doesn't mean Google spyware should be unremovable without breaking it, Google's business model should not be mandated by the law.

So is there anyone else out there attesting device firmware and ensuring they're secure?

It's not a law to only trust Google's attestations.