@whitequark @mwk @millihertz @becomethewaifu lol
well the big problem is that AFAIK (unless you have an external MCU driving FPGA JTAG, which then becomes your root of trust) zynq cannot boot in PL-first mode. you need a FSBL on the PS to come up and load the FPGA before you can do anything in said FPGA.
This is one of the reasons i'm excited to play with the efinix parts, titanium appears to natively support an FPGA-first flow where you can have a true RTL root of trust