The problem with TrustZone is that control of it always resides with a megacorp and never with the owner of the device. It's not that it isn't security at all, but rather that it's security against the owner.
On Raspberry Pi for example, you can write the hash of your own public key to locations 47-54 of the OTP memory block:
https://www.raspberrypi.com/documentation/computers/raspberr...
Here's the QuickStart for the entire process: https://github.com/raspberrypi/usbboot/blob/master/secure-bo...
Note that the Raspberry Pi does not have a full TrustZone implementation to protect secure mode memory, etc. But it is a widely available device with good documentation and allows developers to experiment with and learn about the basics of TrustZone architecture.