As far as I understood, xiaomi.eu counts as a stock ROM for purposes of root hiding and play integrity. This should mean that we don't need PIF or SUSFS (and therefore we can just use LKM mode with KernelSU and forks, rather than a SUSFS-supported GKI).
I tested this myself, and I pass all root detectors, as well as strong integrity, with this setup:
- Redmi K60 (mondrian), HyperOS xiaomi.eu 3.0.8.0 stable (android 15), kernel 5.10.236-android12.
- Resukisu 4.1.0 LKM mode, zygisk next 1.4.5, Hybrid Mount 4.2.0, TEESimulator-RS (Tricky Store also works), HMA-OSS Zygisk 166.
- Valid keybox and proper setup of the above (I use specter for convenience).

My confusion arises from the fact that most xiaomi.eu users seem to be convinced that we need SUSFS and PIF. On the other hand, admins on root-hiding apps seem to agree that we do NOT need them. LLMs insist that we should still use PIF as a backup for when keyboxes are revoked (although, I believe that is due to this outdated article: https://droidwin.com/how-to-pass-strong-integrity-using-revoked-banned-keybox-file/).

My manual testing would strongly imply that neither PIF nor SUSFS are needed. I verified that the xiaomi.eu signature doesn't need spoofing, so that'd leave only fingerprint spoofing as a useful feature of PIF. Can someone confirm how xiaomi.eu affects the device's fingerprint?
And does anyone know whether SUSFS is useful?

There is no 100% answer on this question!
Im lazy and I use GKI because my Revolutm other banks and GPay normaly works without interuption for more then 1 year!!
With LKM I have lot problem and usally banks stop work including gpay every 2 weeks.
Everyone can choose his solutions. I make GKI because I dont have problems at all. Also, I dont care for detectors, play integrity!!!