> It might be possible to push that out over PIO to an external USB 2.0 PHY.
I doubt you will be able to achieve USB HS via a ULPI PHY without an FPGA tunneling the USB SIE for you and handling the tight turnaround requirement (in which case, you might as well give it the entire MAC workload or just use an MCU with an integrated HS PHY.)
The ULPI clock is a 60MHz free-running PHY-sourced signal (typically - some PHYs allow MAC-sourced clocks and this would likely be a little easier), the PHY is entirely in control of when the MAC can transmit (DIR pin), and the protocol is unforgiving from a timing standpoint.