ARM TrustZone is basically just a hypervisor-like execution level that runs above the actual hypervisor called the "secure world", along with ways of calling into it. There's already open-source implementations of the firmware for the secure world on ARM chips, including one from ARM themselves: https://github.com/ARM-software/arm-trusted-firmware

All of the really super-secret security and DRM critical stuff is in the vendor's hardware and code.