So, to be honest, I don't know all that much about the ARM world, and I hadn't heard of TrustZone. I looked it up, and it seems that the OEM has a great deal of discretion in setting it up, to the extent that there's a reference implementation on GitHub [0]. And if I buy a bag of loose SOCs, which I can apparently do now, I'm the OEM.
[0] https://github.com/ARM-software/arm-trusted-firmware