Digital signatures. Not that I actually know how it's implemented, but I would expect someone like Netflix to pay Intel for the build infrastructure to be able

Digital signatures. Not that I actually know how it's implemented, but I would expect someone like Netflix to pay Intel for the build infrastructure to be able to build signed blobs that the SGX will load. The "someone" in your hypothetical can modify the blob, but then they won't be able to resign the blob, so SGX will fail to load it.