You don't have to refuse to take an ARM license (although RISC-V is also a thing). You may not even have to design your own chips at all -- they could just pay

You don't have to refuse to take an ARM license (although RISC-V is also a thing). You may not even have to design your own chips at all -- they could just pay an existing manufacturer for design specifications and then both audit the design and develop and publish open source firmware for it. Supply chain security is an independent problem. First you have to know exactly what the design is supposed to be, only then can you verify that it actually is.