Refer to signatureOrSystem permissions on custom ROM
Basically,
add the required
push apk to /system/priv-app
Done (well, at least works for me).
You do not need to add android:protectionLevel="signatureOrSystem" or android:sharedUserId="android.uid.system". You could sign with any certification.