The owner can control Trustzone if the device is shipped with unfused OTP registers.

On Raspberry Pi for example, you can write the hash of your own public key to locations 47-54 of the OTP memory block:

https://www.raspberrypi.com/documentation/computers/raspberr...

Here's the QuickStart for the entire process: https://github.com/raspberrypi/usbboot/blob/master/secure-bo...

Note that the Raspberry Pi does not have a full TrustZone implementation to protect secure mode memory, etc. But it is a widely available device with good documentation and allows developers to experiment with and learn about the basics of TrustZone architecture.