There are two different Safetynet check levels. One (BasicIntegrity) is easily spoofable, bug GrapheneOS already passes that. The other requires Google certification.

Not possible, you have to run a OS signed by Google.