1. EFR32xG22 doesn't support DPA, only EFR32xG21 supports DPA.

3. Trustzone in Cortex M33 can achieve these requirements but our wireless stack doesn't support TrustZone at this moment.

4. EFR32xG22 doesn't support tamper, only Secure Vault device supports tamper. Please contact our sales for details.

The "Secure boot" is enabled so you must program a signed firmware to recover the device.
Then you can use "Attach to" in Simplicity IDE to start debugging.

You can find the Crypto Profiles' private command (cmd-unsafe-privkey.pem) and sign (rootsign-unsafe-privkey.pem) keys in folder below.
C:\SiliconLabs\SimplicityStudio\v4\developer\adapter_packs\secmgr\scripts\offline

You can use openSSL to generate the public key from private key and use Simplicity Commander to generate the token text file from public key.
The Windows version of openSSL can be downloaded from https://slproweb.com/products/Win32OpenSSL.html

Example:
openssl ec -in rootsign-unsafe-privkey.pem -pubout -out signing-key.pub
commander gbl keyconvert signing-key.pub -o signing-key-tokens.txt

You don't need to specify the device to generate the default configuration file.
commander security genconfig -o user_configuration.json

The EFM32GG11 "helges_demo" example don't use mbed TLS (I suppose trng.c is not available at that time) for random number generation so it directly accesses the TRNG registers.
This example didn't target for random number application, you should refer to EFM32GG11 "persistent_trng" example (use mbed TLS) for random number generation.

The mbedtls_trng_read_chunk() is a static function, you cannot call this function outside trng.c.
The mbed TLS will call mbedtls_hardware_poll() if MBEDTLS_ENTROPY_HARDWARE_ALT and MBEDTLS_ENTROPY_C are defined.
The flow is mbedtls_hardware_poll -> mbedtls_trng_poll() -> mbedtls_trng_read_chunk() and the TRNG FIFOLEVEL is checked before calling mbedtls_trng_read_chunk().

int mbedtls_trng_poll( mbedtls_trng_context *ctx,
                       unsigned char *output, size_t len, size_t *olen )
{
    TRNG_TypeDef *trng = ctx->trng;
    unsigned char *outptr = output;
    size_t output_len = 0;
    size_t count = 0;
    size_t available;
    int ret = 0;

    while (len > 0)
    {
        available = trng->FIFOLEVEL * 4;
        if (available == 0)
        {
            break;
        }
    ...

The AN1220 is the solution for your description "After trying to implement I2C with the LDMA it appears I cant us the LDMA while using any DRV library due to the interrupt call being used in the DMADRV Library.".

The EMDRV is chip independent so you can easily migrate to other chip with minor changes. For emlib, you need to re-write your program if the hardware block architecture is changed (e.g. uDMA to LDMA). You can find related information in AN0918.0.

If you need more control of the peripherals, you should use emlib since EMDRV can't cover all user cases.

The AN1220 is the solution for your description "After trying to implement I2C with the LDMA it appears I cant us the LDMA while using any DRV library due to the interrupt call being used in the DMADRV Library.".

The EMDRV is chip independent so you can easily migrate to other chip with minor changes. For emlib, you need to re-write your program if the hardware block architecture is changed (e.g. uDMA to LDMA). You can find related information in AN0918.0.

The LETIMER can wake the MCU from EM2 and then do the I2C and SPI transfer through LDMA in EM1.

You may not use P2P for I2C to SPI since the LDMA can't handle the handshake between peripherals.

You need to use P2M (I2C->memory) then M2P (memory->SPI).

The SPI and I2C examples can be found on links below.  

https://github.com/SiliconLabs/peripheral_examples/tree/master/series1/usart

https://github.com/SiliconLabs/peripheral_examples/tree/master/series1/i2c/i2c

The I2CSPM_Init() in i2cspm.c is more flexible for I2C initialization (configuration in initialization structure).

What is EM_I2C?