But, I hope they can avoid things like "Intel ME" and "TPM 1/2/...". If these are needed they should fully open the specs to people can inspect them. Also they should be disabled either by jumpers or whatever RISC uses for BIOS.
It's like a USB stick, but more secure, and for just a tiny bit of data. A Yubikey is some kind of TPM. In principle, it cannot be cloned if it falls into the wrong hands. Anybody is welcome to build their own, and they are kind of dumb storage elements (that can also encrypt data you send them), it is just not easy to extract data from them.
You'd have to adapt it to the SoC you're running it on though. Have fun.
If you want to draw a PCB, you can! Just like you can make your own USB-to-SATA board with an ASM1153 though, all you do is draw a board to connect a chip to the outside and give it some supporting crystals. An example TPM chip is SLB 9665, and you can get its datasheet here: https://www.infineon.com/dgdl/Infineon-data-sheet-SLB9665_2.... (if link goes stale, use Google)
As for source code: hardware being closed off is not exactly news (otherwise people would be a lot less angry at firmware issues). There are open-source TPM emulators in use by qemu, so you probably could convince a Raspberry Pi Zero or whatever to pretend to be one by using an emulator and speaking over SPI. There's also a report of TPM on a ARM+FPGA board (https://scholarsarchive.byu.edu/cgi/viewcontent.cgi?article=...) if that's what you want.
The exact pin-out of the slot depends on the motherboard but they are all basically minor variations on the pinout of a 13 pin (14 pin with 1 filled) or 20 pin connector. When you buy your motherboard you can find the full pinout in the manual. That gets you your connector to the motherboard.
For the actual chip itself and the PCB layout, buy an infineon TPM2.0. They cost a few dollars at most. The docs that you can pull off the site include the pinout and operating condition requirements. From that you can build a simple board to run the chip. Hell most of the docs include the plans for one (albeit you might need to change that to fit your mobo.
https://www.infineon.com/cms/en/product/security-smart-card-...
Mostly these days it's an fTPM, implemented in firmware (ME or AMD's "Security Processor") especially when it comes to TPM2.0 which is an entirely new madness of complexity hell compared to TPM1.
From taking a quick search, I selected the first AM5 motherboard I saw from ASRock, MSI, Gigabyte, and ASUS. All had TPM headers buried in the specs or only listed in the manual. Caveat that with ASUS it seems the ROG boards don't have TPM headers but the equivalent ASUS non-ROG boards consistently do.
Point being that they are still quite common and if that's a feature you care about, it's easy to accommodate in any build without even having to look for a different brand. The only issue is that they aren't well advertised or advertised at all.
The whole point of these technologies is to transfer control of the user's computer to various other actors. So in practice this condition (the user retaining control) is not going to be true, so they remain problematic.
To avoid evil maid attacks, there isn't much of an alternative.
TPMs help me have a secure (as in preventing evil maid AND being forensics proof) computer to use. The current TPM2.0 specification had some problems (external TPMs are easy to MITM), so I can't trust it to hold my disk encryption keys. But it still HELPS A LOT in mitigating my risk of typing in my FDE keys into a phishing prompt.
DRMs contribute to worse and worse media playing experience.
Is it this hard to tell apart?
If the supply chain is compromised and you can't trust them, they never needed any new hardware blocks to do bad things. I don't get why people are so obsessed with these new blocks - the level of required trust hasn't really increased.