vilse I got it from Aurora Store, a frontend for the normal Play Store. There are varying opinions on how safe that is but the signing certificate hash is the following if you want to verify it with AppVerifier:
com.bankid.bus
AD:A2:62:4B:35:FC:A3:CC:34:0E:11:89:94:54:E5:50:FB:A9:82:B4:4D:82:B9:7E:FD:16:AA:3A:7A:46:7C:16
In my experience it requires Google play services and Play store, but it only needs them to be installed. You can turn on all exploit protections and deny all permissions (including network) for them and it still works fine.
Edit: BankID, that is. I don't know about Mälardalstrafik.