No no. I believe you. You are right. I am just saying that 0x0 gives the gatekeeper pop up which seemed to be key for me.
Not to reiterate but the first time I installed the original HS release. I did nothing with SIP and got the error and I boot looped - The did SIP enabled, still boot looped. Then added NVWebDriverLibValFix. I was in.
The 2nd time I installed, this was the "newer" High Sierra 14A405 or whatever - First, I couldn't even install it with NVWebDriverLibValFix injecting from Clover. I removed that so I was back to the SAME EFI I was using the first time around. This time, I did CSRActive config 0x0, installed the web drivers, allowed in gatekeeper and rebooted 0x67. No boot loop no drama.
Both were fresh installs from a createinstallmedia made USB stick, minstallconfig.xml "ConvertToAPFS false", with all kexts injecting from Clover.