Hello,
Indeed, using a PSA driver and transitioning to the PSA API is the approach I would recommend. I suggest https://github.com/Mbed-TLS/mbedtls/blob/mbedtls-3.6/docs/psa-driver-example... to get started with driver integration. We are aware that the tooling and documentation are unfinished, so please don't hesitate to ask for help if you get stuck.
If it's exclusively for a TLS server then another approach is MBEDTLS_SSL_ASYNC_PRIVATE (https://mbed-tls.readthedocs.io/en/latest/kb/how-to/ssl_async/). But that doesn't help if you need crypto for anything else.
I would not recommend using MBEDTLS_PK_RSA_ALT_SUPPORT in new code. It's largely untested, and will not be present in future versions of Mbed TLS or TF-PSA-Crypto.
By the way, please note that the 2.28 branch is no longer supported. The current long-time support branch is Mbed TLS 3.6.
Best regards,