The BCM920736, like any other BLE SoC, has hardware AES support, and a true random number generator. In the BLE spec, there are HCI commands for direct access to this hardware, e.g. HCI_LE_Rand and HCE_LE_Encrypt.
Some HCI commands are obviously supported when delivered over the UART - see e.g. Tools/mbt/mbt.cpp.
Can these commands be delivered from the application level - for example to use the built-in AES hardware to perform encryption at the application, not the link layer?
If there is no direct support in the SDK, is there a possibility to use register-level access to deliver HCI commands and receive HCI events?