If you wanted to do something with a hardware root-of-trust, would the GDSII leak needed secrets (i.e. any private keys could be extracted by looking at what you're required to open up), or is that done in some special post-fab way?
Specifially, slides 35-40. You burn a feature fuse to unlock manufacturing test features. The device is personalized with a serial number + told to generate private key + record stored in database. Then, the key is locked in by burning a second feature fuse that disables any future writing to those segments.