How to get microG running on XA2 with SfOs 4.4

Yes, this is right. Signature spoofing must be enabled in the Android compatibility layer on the Jolla side, since it is a feature provided by Android to the (fake) Google Services, not a feature of the Services themselves. Therefore, it must be enabled in the Jolla Settings app, Android App Support section.