As noted in the article I reversed the protocol for a related Goodix device (which was on Intel so used actual SGX instead of the white-box): I used the firmware update system to insert additional vulnerabilities in the sensor firmware and extract the PSK from that side.
I did a talk about it here: https://www.youtube.com/watch?v=IyjUY-xvFw4