Most (if not all) mobile SoCs do implement TrustZone in one way or another. Unfortunately no implementation I know of allows the end user to provide new keys and add code to the trusted part. If that would be possible, you could write trusted code which forces all accesses to the flash controller to be done from secure mode.