Alright, since I got overwhelmed by the SafetyNet requests, I spent several hours today experimenting with it... wasn't fun, so I hope it worth it!

Builds including and after
20171104 (already available for 7.1, will be available soon for 6.0, and sometime later for 8.0 as well once it stabilizes)
should pass SafetyNet as-is after installing the ROM ZIP and the GApps ZIP - there's no need for Magisk (in fact, I won't guarantee that it'll pass after installing Magisk, Xposed, SU, or anything like this - you're on your own in these cases!).
To summarize, I just downloaded the latest build from
https://builds.unlegacy-android.org/aosp-7.1/mako/, and the latest Micro Open GApps for Android 7.1, wiped /cache and /data, and installed these two ZIPs. I then rebooted, set up my Google account in setup wizard, and installed a SafetyNet checker app - see the attachment. Hopefully, everyone will be happy now.
