Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.
It doesn't matter if it looks wrong as long as it looks differently wrong over time. Don't bother trying to blend in with the crowd because you can't ever expect to catch everything that can be used to fingerprint you. New techniques come out all the time. You can block a lot of information from even being collected. Limit what data you send at all, randomize what's left, change IP frequently (VPN) and you should be fine.
For a more proper solution, you could try to convince Mozilla that granting every website uncapped multi-threading and direct GPU access is a bit much. If webgl/webgpu truly is a must, then maybe each website permission should start with a single-threaded software-renderer that behaves indistinguishable on all supported platforms. And only after granting the website that extra permissions let it determine that a more powerful GPU is available.
https://jshelter.org/faq/#what-jshelter-configuration-should... :
First, see our blog post. Consult also other blog posts and other questions in this FAQ.
If you want to have the same fingerprint as many users, We suggest going for Tor Browser (do not install JShelter in Tor Browser). If you want to make cross-site fingerprinting linkage hard, go for the Recommended JShelter level. If you want better protection for the real data at the cost of having the same fingerprint on different sites, go for the Strict JShelter level. Keep NBS active. If you want to detect and prevent fingerprinting attempts, use FPD.
On the technical level there is no problem to block tracking - intriduce noise and make APIs unavailable until user permits to a web site. But that is not implemented.
The same with native applications. If your bank app requires you to share your location you can't spoof it. The makers of Android and iOS made spoofing of geo location impossible - you don't have that control, which means the phone is not your device. You have to give up your real location.
That's basically the ideal. It's become obvious that it's impossible to try to be identical. Web browsers are too leaky, and something will out you. You really don't want to try to blend in the "typical" users because none of them use ad blockers.