Symptom
The actual certificate from keytool -printcert -jarfile and the console's App Integrity screen show different fingerprints. Reproduced on two apps.
Fix (standard)
Don't argue; inject all three keys into assetlinks: ① the Play app signing key ② the upload key the console shows ③ my build key. Whichever is real, it works. Let the server override via env var, but bake the three keys in as the default.
Confusion warning
If you see "signed with the wrong key," first suspect you picked the wrong app. That error came from uploading this app's aab onto another app's page (check the app badge top-right first).
unzip -p X.aab base/manifest/AndroidManifest.xml | strings | grep -oE "app\.[a-z]+\.twa"
keytool -printcert -jarfile X.aab | grep SHA1