An interesting approach to vendor-independent attestation was outlined in [1]. Basically the bitstream is fed into a physical unclonable function (PUF) which is used to derive a key to decrypt the rest of the bitstream. For attestation, one could simply store the secret part of an asymmetric key in the encrypted bitstream (for challenge-response).

[1]: An Autonomous, Self-Authenticating, and Self-Contained Secure Boot Process for Field-Programmable Gate Arrays, https://www.mdpi.com/2410-387X/2/3/15