A little searching found the PIC24FJ128GB202. This is a spectacularly good fit:

• Q:100 pricing at DigiKey of just over $3 in SSOP-28 package
• hardware AES
• hardware TRNG
• USB full speed support
• 2 SPI interfaces (an SD card is essentially an SPI device)

At first blush full speed seems like a bad way to go, but it's not as bad as it first may seem. Even a class 10 SD card can only do 80 mb/s, so 12 mb/s at least is less than an order of magnitude slower. Additionally, the use case here isn't really for speed as much as it is for security.

Still, this is just after 5 minutes of investigation. If going to high speed instead of full speed is doable without huge added cost or trouble then it's worth considering.

Besides, I don't have any PIC toolchain or anything at all, so that's gonna be an issue.