[Natanael_L]

USB Armory seems to be doing exactly what you ask for with ARM TrustZone. You own the SoC and can set your own master keys.