TrustZone is, for practical purposes, a little more open if you're the one designing the board. Most of the time, the crypto is opt in, and you as the final assembler control the keys.