Looking for backdoors could possibly turn up something interesting, but I would suspect that most backdoors if they exist are going to be in the microcode/firmw

Looking for backdoors could possibly turn up something interesting, but I would suspect that most backdoors if they exist are going to be in the microcode/firmware rather than the hardware. Assuming it's an encrypted blob you can't inspect outside of a running system, you'd probably have to scan both the physical layout of the chip and the electrical state, and then load both into some kind of simulator for debugging.