The Nexus 6's L1 keys were dumped through a vulnerability in Qualcomm's trusted code execution environment.

http://bits-please.blogspot.com/2016/05/qsee-privilege-escal...

https://googleprojectzero.blogspot.com/2017/07/trust-issues-...